feat(runtime): phase 1 — peel timers/io/monitor-id out of SharedState; gate stop sentinel behind PREEMPTION_ENABLED

- next_monitor_id -> AtomicU64 on RuntimeInner
- timers -> own Mutex<Timers>; io -> own Mutex<Option<IoThread>> (lock order: io-before-shared)
- pending_closures Vec folded into Slot::pending_closure
- termination check reads io liveness before shared; ordering argument documented
- poison fix: check_cancelled() no longer fires while preemption is disabled,
  so a cancellation unwind can never poison a runtime/channel mutex
- regression test: tests/poison_stop.rs
- ROADMAP_v0.5.md added

src/monitor.rs

@@ -117,17 +117,17 @@ pub fn monitor(target: Pid) -> Monitor {
     // we must not *send* here, as `Sender::send` can call back in to unpark a
     // parked receiver and the shared mutex is not reentrant.
     let (id, registered) = with_runtime(|inner| {
-        inner.with_shared(|s| {
-            let id = s.alloc_monitor_id();
-            let registered = match s.slot_mut(target) {
+        let id = inner.alloc_monitor_id();
+        let registered = inner.with_shared(|s| {
+            match s.slot_mut(target) {
                 Some(slot) if !matches!(slot.state, State::Done) => {
                     slot.monitors.push((id, tx.clone()));
                     true
                 }
                 _ => false,
-            };
-            (id, registered)
-        })
+            }
+        });
+        (id, registered)
     });
 
     if !registered {