[BUG](dispatcher): shut down IO runtime cleanly without async-context panic

[rescrv]

Description of changes

Change io_runtime from Arc to Option so the dispatcher
owns the runtime exclusively and can shut it down on stop. The on_stop
lifecycle method now takes the runtime and shuts it down with a 5-second
timeout via spawn_blocking, avoiding the panic that occurs when dropping
a Tokio runtime from within an async context.

Add a Drop impl as a safety net that calls shutdown_background() for
the non-blocking fallback path. When the runtime has already been taken
(after stop or drop), incoming IO tasks are aborted with a metric.

Test plan

CI

Migration plan

N/A

Observability plan

See prod not panic on shutdown. Ditto for test.

Documentation Changes

N/A

Co-authored-by: AI

[github-actions]

Reviewer Checklist

Please leverage this checklist to ensure your code review is thorough before approving

Testing, Bugs, Errors, Logs, Documentation

• Can you think of any use case in which the code does not behave as intended? Have they been tested?
• Can you think of any inputs or external events that could break the code? Is user input validated and safe? Have they been tested?
• If appropriate, are there adequate property based tests?
• If appropriate, are there adequate unit tests?
• Should any logging, debugging, tracing information be added or removed?
• Are error messages user-friendly?
• Have all documentation changes needed been made?
• Have all non-obvious changes been commented?

System Compatibility

• Are there any potential impacts on other parts of the system or backward compatibility?
• Does this change intersect with any items on our roadmap, and if so, is there a plan for fitting them together?

Quality

• Is this code of a unexpectedly high quality (Readability, Modularity, Intuitiveness)