Stop the JSONRPC server cleanly on stdin EOF instead of busy-looping

Start at crates/pet-jsonrpc/src/server.rs, especially start_server, and trace the transport read loop and shutdown path. Reproduce the stdin-EOF behavior with the bounded subprocess harness described in the issue, then add injectable-reader tests for clean and truncated EOF cases plus read errors. Done means deterministic cleanup and successful exit within one second across platforms without disrupting valid streaming.

Tracking plan: #528
Priority: P1. Evidence: reproduced on Windows at 4e523ba.

Problem

The server treats stdin EOF as an empty header and immediately repeats the read/error loop instead of exiting. In a bounded reproduction, closing stdin after a successful info exchange left PET alive after 251 ms, consuming 234 ms of CPU and writing at least 991,232 bytes to stderr.

Source: start_server.

Reproduction

Start pet server with piped stdin/stdout/stderr. Send a correctly framed info request and wait for its response. Close the parent's stdin pipe while continuing to drain stderr. Observe that PET does not exit and repeatedly logs a missing Content-Length error. Use a bounded harness that terminates only its own child after observing the behavior.

Scope

• Treat EOF at the next-frame boundary as normal termination; distinguish truncated headers/payloads from clean EOF.
• Return from the transport loop rather than using an unconditional diverging loop, and define server shutdown/worker cleanup behavior.
• Keep broken-pipe/read/write failures explicit without retrying indefinitely or polluting protocol stdout.
• Make the transport reader injectable so EOF and partial-read tests do not require a permanently running server.

Acceptance criteria

• Closing stdin after a normal exchange exits the subprocess successfully within 1 second on Windows, Linux, and macOS, without a busy loop or error flood.
• Clean EOF, EOF during a header, EOF during a payload, and actual read errors have deterministic tests and documented outcomes.
• Shutdown during an active request does not leave orphaned work or wait forever; cleanup semantics are tested.
• Existing valid request/notification streaming continues to work.
• Test clients can request normal shutdown/close input and use forced termination only as a bounded failure fallback.

Dependencies

No prerequisite. Land early: correct shutdown enables trustworthy coverage collection from server subprocesses. Keep framing/ID expansion in its separate issue under #528.