- Stop closes the control server right after the deactivation-pin check,
so a stopping process no longer answers /started for its successor.
releaseResources still closes it for stop paths that skip Stop; a
sync.Once makes the double close safe.
- upgrade and restart wait for a 200 from /started via
newReadySocketControlClient; a 408 (start never finished) now rolls the
upgrade back and makes restart warn instead of reporting success.
- The plain socket client still accepts any answer, for the
deactivation-pin path.
