Workers and session clients gain a 'hosted' lifecycle distinct from owning the process

What

• Hooks-worker and CCR worker registration now branches on a kind of owns-process vs hosted. In hosted mode, a registration failure or epoch-mismatch stops the session gracefully — with a mapped close code/reason such as lease-superseded or auth-rejected — instead of exiting the process; shutdown-cleanup and process-exit hooks are only registered for owns-process.
• The CCR worker's init logic follows the same split: the owns-process path exits the process on registration failure and registers its own shutdown cleanup, while the new hosted path calls stopFor(...) with a structured reason (e.g. registration-failed, with an HTTP status and close code 4091) instead of killing the process, and adds an epoch-mismatch handler mapping close codes 4090/4094 to lease-superseded/auth-rejected.
• The telemetry/session client's cleanup logic was refactored from an inline constructor closure into explicit beginShutdown()/finishShutdown() methods, plus new goodbye(), stopFor(), closeConnections(), acceptsInboundEnvUpdates(), and exitOnFatalInput() methods that branch on whether the process owns itself or is hosted by another process (e.g. a CCR client).
• Background workers now refuse untrusted inbound environment-variable updates: a new acceptsInboundEnvUpdates() gate checks before applying an update_environment_variables message. A hosted worker always refuses; a process-owning worker only accepts if its hosting descriptor says trustsInboundEnvUpdates. Refused updates are logged as a warning and the message is discarded rather than silently dropped.
• When an incoming stream-json input line exceeds the maximum line length, the code now routes through the new exitOnFatalInput(...) method (at both the "tail" and "block" warning sites) instead of a generically named handler.

Why This separates "this process owns its own lifecycle" from "this process is hosted inside another one" (e.g. run via CCR), so a hosted worker can be stopped cleanly with a specific reason instead of exiting the whole process, and so it won't blindly trust environment-variable updates from outside.