Allow running-to-failed when D stopped before shutdown

The round-19 precedence rule (D's earlier stop reason beats shutdown)
needs a matching transition guard. Found while implementing F1a.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

docs/implementation/runner-lifecycle.md

@@ -105,7 +105,7 @@ Any change not in this table is illegal. The `Store` refuses it.
 | `pending` | `failed` | Preparation or launch error | Same attempt ID; state is `pending`; **no first reason recorded; captured context still current** (otherwise the row takes `stale`) |
 | `pending` → `pending`, `running` → `running` | same state, first reason set | A stop request ("Stopping") | Same attempt ID; state unchanged; **first reason is null**. It sets the first reason, and the attempt's state stays the same. The state version increases. This is how rule 1 of "Rules for the running state" becomes durable. |
 | `running` | `completed` | Validated result | Attempt ID is current; state is `running`; no first reason recorded; captured context still current; **task status is not closed (neither `merged` nor `cancelled`) and `cancel_requested` is null** |
-| `running` | `failed` | Settled with an error or invalid output | Attempt ID is current; state is `running`; **no first reason recorded; captured context still current** (otherwise the row takes `stale`) |
+| `running` | `failed` | Settled with an error or invalid output | Attempt ID is current; state is `running`; captured context still current (otherwise the row takes `stale`); and **either no first reason recorded, or first reason `shutdown` with a D `stopReason` of `timeout`, `output-limit` or `capture-failure`** (D stopped first; see rule 2) |
 | `running` | `cancelled` | Settled after a user, hard-stop, shutdown or time-limit reason | Attempt ID is current; state is `running`; first reason is `cancelled`, `shutdown` or `time-limit` |
 | `running` | `stale` | Settled after the context changed | Attempt ID is current; state is `running`; first reason is `stale`, **or** no first reason is recorded and the context is no longer current (a change made by another transaction that the runner had not yet seen) |
 | `pending` or `running` | terminal state from the first reason, or `failed` if there is none | Startup recovery (the previous process died). Uses the same first-reason mapping as settlement. | Runs before admission opens, after D's recovery has removed leftover containers |