P4. Ctrl-C, with no PyErr_CheckSignals to call

Specification: [`07-python-bindings.md`](../blob/main/docs/specs/07-python-bindings.md) section 6, [`12-the-python-front-door-measured.md`](../blob/main/docs/specs/12-the-python-front-door-measured.md) section 5.

Ctrl-C interrupts a running query at the next morsel boundary and raises `KeyboardInterrupt`. pandas cannot do this reliably and everybody who has killed a notebook kernel to escape a runaway `groupby` will notice.

### The finding

`PyErr_CheckSignals` is not exposed by `std.python._cpython`. The compiler's answer is flat: `'CPython' value has no attribute 'PyErr_CheckSignals'`. `PyErr_SetInterrupt` is not there either. So the exit criterion has no mechanism behind it as things stand, and this is a piece of engineering with a design question in it rather than a checkbox.

### The two routes

**Resolve the symbol ourselves.** libpython is already loaded in the process, so `dlsym` will find `PyErr_CheckSignals`, and then the morsel loop calls it exactly as document 07 describes. A small amount of unpleasant code in one place, and it depends on Modular adding nothing. The risk is that the lookup is fragile across platforms and across static versus shared libpython builds, which is the thing to establish first.

**Keep the check on the Python side.** Run the query on a worker thread and let the main thread take the signal, which is what several other extensions do and which needs no new symbols. The cost is that it changes the threading model of every call and interacts with the GIL release, so it is the fallback.

The recommendation is the first, with the second behind it.

### Scope

- [ ] Establish whether `dlsym("PyErr_CheckSignals")` resolves on macOS arm64 and on manylinux, against both a shared and a static libpython
- [ ] The cancellation flag, checked at the morsel boundary, set from the signal check
- [ ] The Mojo side raising the cancellation error, mapped to `KeyboardInterrupt` by the error issue
- [ ] A test that starts a long query, sends `SIGINT`, and asserts `KeyboardInterrupt` arrives and the process is still usable afterwards
- [ ] A test that the interrupt does not leave a partially built frame reachable

### Depends on

The error mapping issue, for the `KeyboardInterrupt` row.

Start with sections 6 and 5 of docs/specs/07-python-bindings.md and docs/specs/12-the-python-front-door-measured.md, then establish whether dlsym("PyErr_CheckSignals") works on the listed macOS arm64 and manylinux configurations. Trace the morsel-boundary cancellation path and the error-mapping dependency; done means SIGINT raises KeyboardInterrupt, the process remains usable, and no partial frame is reachable.

Written by the indexing model from the issue text.