Make CbfNode::run return an error when called more than once in 4.0

### Context

Follow-up to #1062 and tracked for the next breaking release in #1036.

Commit `f5c5ebc` fixed the binding-facing panic from calling `CbfNode::run()` more than once by making subsequent calls no-ops. That was appropriate for the current non-breaking release, but it silently hides an invalid lifecycle call.

As discussed in #1062, the 4.0 API can make this state explicit and align `run()` with `CbfClient::shutdown()`, which already returns a `CbfError` when the node is no longer running.

### Proposed change

Change the exported method from:

```rust
pub fn run(self: Arc)
```

to:

```rust
pub fn run(self: Arc) -> Result<(), CbfError>
```

The first call should start the node and return `Ok(())`. A later or concurrent call after the inner node has been consumed should return a binding-visible `CbfError` rather than panic or silently succeed.

This does not make `CbfNode` restartable; `run()` remains one-shot.

The implementation could either reuse `CbfError::NodeStopped` for consistency with `shutdown()` or introduce a more specific variant such as `NodeAlreadyStarted`. Maintainer preference should determine the exact error semantics.

### Acceptance criteria

- `CbfNode::run()` returns `Result<(), CbfError>`.
- The first call returns `Ok(())` and starts the node.
- A second or racing call returns a typed error without panicking.
- Generated binding call sites and tests are updated for the throwing API.
- Regression coverage verifies the consumed-node path.
- The PR is marked as an API-breaking 4.0 change.

### References

- Original panic report and non-breaking fix: #1062
- 4.0 breaking-change tracker: #1036
- Fix commit: `f5c5ebc8299f4f6cd135d23b3ba75cc24ab12751`