Follow-up to #5840 (autonomous goal runner), addressing the three items from review.

1. Goal-run self-cleanup race (correctness)

The spawned loop's trailing runs.remove(&goal_id) ran unconditionally when run_loop completed naturally. If a concurrent start() for the same goal had already replaced the run (aborting the old task and inserting a new handle), the old task — finishing naturally at nearly the same instant — would remove the new run's handle, orphaning a live loop: unstoppable via stop(), invisible to state(), and only self-terminating at the iteration cap.

Fix: each run is tagged with a monotonic generation (AtomicU64 on the runner), and the task self-cleans via runs.remove_if(&goal_id, |_, h| h.generation == generation) so it only ever drops its own entry. Abort was already safe (an aborted future never reaches the cleanup); this closes the natural-completion case.

2. Remove dead is_running

pub fn is_running had no callers (routes use state()); removed.

3. Termination test coverage

#5840 shipped tests only for GOAL_DONE and max_iterations. Added run_loop tests for the paths that matter most for an unattended loop:

• operator stop flag (no tick runs)
• kernel shutdown signal (no tick runs)
• GOAL_BLOCKED (ends as Stopped, goal not marked completed)
• consecutive-rate-limit circuit breaker (start_paused skips the inter-tick sleeps, asserts it trips before the iteration cap)

Verification

• cargo clippy -p librefang-kernel --lib -- -D warnings — clean (dev container)
• cargo test -p librefang-kernel --lib goal_runner::tests — 7 passed (4 new + 3 existing)