Fix flaky test_kick_scan_is_idempotent (drain scan threads)

[cryptopoly]

Summary

• Race in tests/test_state_async_library.py::AsyncLibraryScanTests::test_kick_scan_is_idempotent caused intermittent CI failures (OSError: [Errno 39] Directory not empty).
• Daemon library-scan threads spawned by _kick_library_scan had no handles, so tearDown's tmp.cleanup() could rmtree the tmpdir while a thread was still writing library_cache.json.
• All four post-merge dependabot CI runs on main (Bump actions/upload-artifact from 6 to 7 #6, Bump tauri-apps/tauri-action from 0.6.0 to 0.6.2 #7, Bump actions/github-script from 8 to 9 #8, Bump libc from 0.2.185 to 0.2.186 in /src-tauri #9) hit the same race — the bumps themselves were fine.

Fix

• Track spawned scan threads on ChaosEngineState and prune dead entries on each kick.
• Add idempotent ChaosEngineState.shutdown(timeout=5.0) that joins all alive scan threads.
• Tests assign their constructed state to self.state and drain it in tearDown before self.tmp.cleanup().

Verification

• tests/test_state_async_library.py now deterministic locally (5/5 runs).
• Full backend pytest green on Linux runner via run 25129383727 (test job + 3-OS build matrix all ✓).
• npx tsc --noEmit clean.
• npm test 179/179 pass.

Test plan

• Target test 5×
• Full backend pytest
• TypeScript typecheck
• Vitest suite
• CI matrix (test + macos-latest + ubuntu-22.04 + windows-latest) on workflow_dispatch