#35932 ipc: make ipc::disconnectIncoming wait for in-progress calls to complete

• Prevent assertion crashes during node shutdown when IPC requests are still in progress
• Ensure worker threads finish executing active IPC calls before node subsystems are reset

Separates connection teardown from destruction in libmultiprocess and introduces a server object tracker to monitor live ProxyServer instances. Updates `ipc::disconnectIncoming` to wait off the event loop until worker threads finish executing in-flight server method bodies before destroying connections and allowing node shutdown to proceed.

Problem: During node shutdown, `Ipc::disconnectIncoming` cancels KJ promises but does not wait for asynchronous method bodies running on worker threads (e.g. `Mining.checkBlock`) to complete. Those calls can dereference freed node state like `chainman`, triggering assertion failures such as `Assert(m_node.chainman)` reported in #35845 and #33387.

P2 · bug fix

• P2 because it fixes shutdown assertion crashes when IPC calls run concurrently with teardown
• Reliable disconnect handling during shutdown is critical for stable external IPC usage

P2 because it resolves a concrete crash hazard where in-flight IPC calls outlive shutdown and dereference freed node structures. The description cites bug reports #35845 and #33387 found by Antithesis testing, where asynchronous mining calls trigger `assert(m_node.chainman)` during shutdown.

Membership: Changes IPC connection shutdown in `src/ipc/capnp/protocol.cpp` and `src/ipc/libmultiprocess/`.

Factors: security/stability 2, bug 2, performance 0, user value 1, leverage 1

• CI is failing on the latest push
• Based on unmerged upstream libmultiprocess pull request 335

CI is failing, and the author notes that this draft is based on an unmerged upstream PR in bitcoin-core/libmultiprocess#335.

Author status: silent since 2026-08-12

• No reviews or comments yet
• Waiting for initial review feedback

Crickets; no reviews or comments yet.

The PR was opened as a draft based on upstream libmultiprocess work and has not received reviewer engagement.

Objections: none enumerated.

State derived from the lists: no substantive comment either way

Review verdicts (DrahtBot): 0

0 lines under test/bench/ci.

• src/ipc/libmultiprocess/include/mp/proxy-io.h +151/-14
• src/ipc/libmultiprocess/test/mp/test/test.cpp +71/-0
• src/ipc/libmultiprocess/src/mp/proxy.cpp +60/-5
• src/ipc/capnp/protocol.cpp +50/-2
• src/ipc/libmultiprocess/include/mp/proxy.h +7/-0

This PR modifies IPC connection shutdown handling so that disconnectIncoming waits for in-flight server call bodies executing on worker threads to drain before node shutdown continues. This fixes an assertion crash on shutdown reported by Antithesis in #35845 and #33387 where asynchronous mining methods dereference chainman after it has been reset. The PR is a draft with failing CI that depends on upstream changes in bitcoin-core/libmultiprocess#335, and has received no reviews yet.