review: use RLock in Registry.Close, add shutdown log, test double-close

- Use RLock/RUnlock instead of Lock/Unlock in Registry.Close() since
  the guards map is only read (not modified) during the closers scan
- Add summary LogInfo after closing guards for shutdown visibility
- Add double-close idempotency test with closeCount tracking on mock

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

internal/guard/guard_test.go

@@ -21,12 +21,14 @@ type mockGuard struct {
 // mockClosableGuard is a guard that tracks whether Close was called
 type mockClosableGuard struct {
 	mockGuard
-	closed   bool
-	closeErr error
+	closed     bool
+	closeCount int
+	closeErr   error
 }
 
 func (m *mockClosableGuard) Close(ctx context.Context) error {
 	m.closed = true
+	m.closeCount++
 	return m.closeErr
 }
 
@@ -514,6 +516,17 @@ func TestGuardRegistry_Close(t *testing.T) {
 		assert.True(t, g1.closed, "expected failing guard Close to be called")
 		assert.True(t, g2.closed, "expected ok guard Close to be called")
 	})
+
+	t.Run("double close is safe", func(t *testing.T) {
+		registry := NewRegistry()
+		g := &mockClosableGuard{mockGuard: mockGuard{id: "wasm"}}
+		registry.Register("server1", g)
+
+		registry.Close(context.Background())
+		registry.Close(context.Background())
+
+		assert.Equal(t, 2, g.closeCount, "Close should be called twice without panic")
+	})
 }
 
 func TestCreateGuard(t *testing.T) {

internal/guard/registry.go

@@ -111,20 +111,23 @@ func (r *Registry) Close(ctx context.Context) {
 		c  interface{ Close(context.Context) error }
 	}
 
-	r.mu.Lock()
+	r.mu.RLock()
 	closers := make([]closableGuard, 0, len(r.guards))
 	for id, g := range r.guards {
 		if c, ok := g.(interface{ Close(context.Context) error }); ok {
 			closers = append(closers, closableGuard{id: id, c: c})
 		}
 	}
-	r.mu.Unlock()
+	r.mu.RUnlock()
 
 	for _, guard := range closers {
 		if err := guard.c.Close(ctx); err != nil {
 			logger.LogWarn("guard", "Failed to close guard for server %s: %v", guard.id, err)
 		}
 	}
+	if len(closers) > 0 {
+		logger.LogInfo("guard", "Closed %d guard(s)", len(closers))
+	}
 }
 
 // GuardFactory is a function that creates a guard instance