Extend C-367 with the shutdown rule for http.serve

[O6lvl4]

Adds the shutdown rule to C-367 (almide/almide#2692, ADR-0020 §5.6 in almide/almide), ahead of the implementation.

New wording (appended to C-367's stream rules):

• On the first SIGTERM or SIGINT (Ctrl-C or Ctrl-Break on Windows) while http.serve runs, the host:
  • stops accepting;
  • finishes and answers the request in flight;
  • flushes stdout;
  • returns from http.serve. The statements after it run, and main's exit code is the exit code.
• A second signal (during the drain, or after serve returned), or a drain still waiting after the 30 s request timeout: the host flushes stdout and exits 1. It does not answer the request in flight, and no stop uses a 128+signal code (C-350).
• NOT covered:
  • other signals;
  • the forced stop on native Windows, which exits 1 without flushing, because only the serving thread can reach its stdout buffer until ADR-0020 §5.5 makes stdout one process-global buffer.

Evidence: a new server fixture, spec/serve_cross/http_serve_shutdown.almd. The implementation's driver (tests/http_serve_cross_test.rs in almide/almide) starts it on both legs with stdout redirected to a file and checks two cases:

• one SIGTERM while a request sleeps: the request is answered, every line is in the file (including the one main prints after serve), and the exit code is 0;
• two SIGTERMs while a request stalls: the exit code is 1, and every line printed before the stop is in the file.

ALS-R5's prose carries the same rule, and its validation row is restamped. spec/serve_cross/http_serve_replay.almd is not touched (that sync is #109).