fix(lifecycle): treat cancellation during actor startup as graceful shutdown

[dorothyyzh]

Slack: https://theplant.slack.com/archives/C09H5U13GJY/p1783419772718129

Problem

A shutdown request (context cancellation) that arrives while an actor is still starting is reported as a startup failure. The startup loop in Serve returns the actor's error unconditionally:

if err := actor.Start(ctx); err != nil {
    logger.ErrorContext(...)
    return err
}

…while the run phase already treats context.Canceled as a clean exit:

err := g.Wait()
if err == nil || errors.Is(err, context.Canceled) || errors.Is(err, errServiceCompleted) {
    return nil
}

So the same shutdown signal is graceful if it lands one millisecond later, but a "failure" if it races the startup sequence.

Real-world impact

• Flaky TestHealthyEndpoints in ciam-next (failing run): the test cancels the serve context right after health checks pass; when the cancel lands inside the challenge janitor's ~1.6ms seed-job enqueue transaction, database/sql aborts with context canceled, Serve reports it as Failed to start service, and the test fails.
• In production, a SIGTERM landing in the startup window makes the process exit non-zero, which K8s rolling updates read as a crash instead of a normal termination.

Fix

Align the startup loop with the run-phase semantics: if the serve context has been cancelled, log the aborted actor at info level and return nil — the deferred cleanup stops already-started actors as usual.

Two deliberate choices:

• Detect via ctx.Err(), not the returned error. The cancellation may be masked by intermediate layers (database drivers can surface it as e.g. driver: bad connection), while "the serve context is cancelled" is unambiguous: once shutdown is requested, whatever Start returned is moot.
• context.DeadlineExceeded still surfaces as an error, matching the run phase (TestServeConvenienceFunction relies on this distinction).

Testing

• New TestServeCancelDuringActorStartup reproduces the race deterministically (fails on main, passes with the fix) and pins that a real startup failure is still reported.
• Full suite + go vet + golangci-lint run (v2.11.3, same as CI): clean.
• Verified end-to-end against ciam-next via a local replace: TestHealthyEndpoints passes.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.