fix(worker): reply WorkerUnavailable to commands that race shutdown (#182)

TryStartCommandTask returned silently when command intake had stopped, so a
command refused during shutdown got no reply and no log and the gateway's
correlation wait ran out its own timeout. The refusal now writes a
WorkerUnavailable reply for the correlation and logs
WorkerCommandRejectedAfterShutdown. StopAcceptingCommands is internal so the
test can reach the guard (the serial read loop cannot race it today).

Test: WorkerPipeSessionTests.CommandAfterShutdown_RepliesWorkerUnavailable.

docs/MxAccessWorkerInstanceDesign.md

@@ -1011,7 +1011,11 @@ Graceful shutdown sequence:
 
 1. Pipe reader receives `WorkerShutdown`.
 2. Worker host marks shutdown requested.
-3. Reject new commands.
+3. Reject new commands. A command that reaches the dispatcher after intake has
+   stopped is answered with a `WorkerUnavailable` reply and logged as
+   `WorkerCommandRejectedAfterShutdown`, so the gateway's correlation wait ends
+   at once instead of running out its own timeout. The read loop is serial and
+   stops after the shutdown frame, so this guard is defensive today.
 4. Let current STA command finish if within timeout.
 5. Optionally run MXAccess cleanup:
    - `UnAdvise`,