Remove race condition during module host exit

[joshua-spacetime]

Description of Changes

Previously exit_module_host removed a replica's HostCell before acquiring the write lock and shutting down the module/database. A concurrent access path could then create a second cell for the same replica while the old host was still exiting.

This change keeps the existing cell registered during shutdown, marks it as Exiting, and removes it from the map while still holding the write lock. Queued waiters on the old cell will then observe that it is no longer current and fail rather than initializing through stale state.

exit_module_host still returns after the provided timeout, but the shutdown task continues in the background and keeps blocking new host creation until cleanup completes.

API and ABI breaking changes

None.

Expected complexity level and risk

3

Testing

This should fix hangs/flakiness in pause/unpause and suspend/unsuspend smoketests such as unpause_makes_database_accessible_again, where a pause-triggered host exit can race with a subsequent access or relaunch.