…umbing

`LocalApp::start` previously spawned `execute_local_app` with a
`oneshot::Sender<i32>`; every `?` early-return in that task dropped the
sender silently, and `LocalApp::status()` reported the resulting closed
channel as `Error::WaiterClosed` — losing the actual cause (env join
errors, `tower_uv::Error` variants, panics, etc.).

Replace the channel payload with an internal `AppCompletion` enum and a
new `Status::Failed(AppFailure)` shape that preserves the structured
error. Highlights:

  - `AppCompletion` (internal) has `Exit(i32)`, `Cancelled`,
    `Failed(AppFailure)` variants. The spawn wrapper in `LocalApp::start`
    runs `inner_execute_local_app` inside `AssertUnwindSafe(...).catch_unwind()`
    and always sends an `AppCompletion` before exiting, so a closed waiter
    channel can no longer mask a real failure.

  - `Status::Failed(AppFailure)` replaces the old
    `Status::Failed { error_code, error_message }` strings.
    `AppFailure` has:
      * `Runtime(Error)` — structured runtime error
      * `Panic(String)` — `catch_unwind` payload
      * `Platform { error_code, error_message }` — opaque strings for
        callers that construct `Status::Failed` from outside
        `tower_runtime` (e.g. Kubernetes pod-status reconciliation).
    Stringification (`error_code` / `error_message`) is the consumer's
    responsibility, not the runtime's.

  - `Status::Cancelled` is a new terminal variant for explicit
    cancellation via the `CancellationToken`. Previously cancellation
    was represented as `Crashed { code: -1 }`, indistinguishable from
    an app that legitimately exits with code 255 / -1 or an IO error
    in `wait_for_process`. `inner_execute_local_app` now returns
    `Err(Error::Cancelled)` on every cancellation path (4 prologue
    checks + 3 post-`wait_for_process` checks that disambiguate
    cancellation from a child's genuine non-zero exit), and the spawn
    wrapper special-cases that into `AppCompletion::Cancelled`.

  - `Error` gains `Clone + PartialEq + Eq` (all variants are unit, so
    this is free) so `Status` can keep deriving `Clone + PartialEq`,
    which is required by status caching in `LocalApp::status()` and by
    existing integration tests.

  - `tower-cmd` (the only other in-crate consumer of `Status::Failed`)
    is updated for the new variant shape and prints a dedicated
    "cancelled" message for `Status::Cancelled`.

  - The integration test `test_abort_on_dependency_installation_failure`
    keeps asserting that `uv sync` non-zero exits surface as
    `Status::Crashed { code }` — `Status::Failed` is reserved for
    platform failures where the child never ran.

`Error::WaiterClosed` now only fires when the spawn was aborted or the
runtime was dropped — both real bugs worth surfacing as-is.