certbot: shutdown cancels an in-flight ACME order and skips DNS-01 TXT cleanup

Follow-up to #924.

The shutdown path added in #924 cancels the daemon future rather than letting it unwind:

```rust
// dstack/certbot/cli/src/main.rs
tokio::select! {
_ = bot.run() => unreachable!("certbot daemon returned"),
result = shutdown_signal() => result?,
}
```

If the signal lands while `renew_inner` is mid-ACME-order, `bot.run()` is dropped at its current await point and the cleanup at the end of the DNS-01 flow never runs:

```rust
// dstack/certbot/src/acme_client.rs:185
if let Err(err) = self.dns01_client.remove_record(&challenge.id).await {
error!("failed to remove dns record {}: {err}", challenge.id);
}
```

Result: a stale `_acme-challenge` TXT record left in the DNS zone, plus a pending authorization at the CA.

This is **not a regression** — before #924 the default SIGTERM disposition killed the process at the same point with the same effect — and it is self-healing, because `set_txt_records` calls `remove_txt_records(&acme_domain)` before publishing new ones on the next attempt. But "stop the daemon cleanly" currently means "stop promptly", not "stop without leaving state behind", and the gap is worth closing.

## Proposal

Give the loop a cancellation token instead of dropping the future:

- check the token at the top of each iteration and in the interval wait (`select!` between `sleep(renew_interval)` and cancellation) — this covers the idle case, which is the overwhelmingly common one and is already instant today;
- for the in-flight case, either let the current renewal run to completion under a bounded grace period before exiting, or make the DNS-01 challenge cleanup drop-safe (scope guard) so cancellation at any await point still removes the TXT record.

The grace period must stay bounded — `renew_timeout` already caps a single renewal, so reusing it as the shutdown deadline is a reasonable ceiling.

阅读 dstack/certbot/cli/src/main.rs 和 dstack/certbot/src/acme_client.rs，重点查看 shutdown select、renew_inner 流程以及第 185 行附近的 DNS-01 清理。跟踪现有的 renew_timeout 行为，并运行 certbot 测试或与 shutdown 相关的检查。完成的标准是：shutdown 能在有界期限内处理空闲和正在进行的续期，同时不遗留 TXT 记录或授权状态。

由索引模型根据 Issue 内容生成。