fix: close billing and batch shutdown races

[CMGS]

Summary

• keep attributed ledger writes batched while waiting for the shared-store commit before request completion, so per-user usage reads on another Gateway instance observe completed Instar calls
• stop distributed batch claiming when shutdown begins, finish the claimed batch, and flush billing only after the drain task exits
• cover the attributed repair acknowledgement path

Verification

• static source review and cargo fmt --all
• lint, tests, and compilation were not run locally; CI owns those gates for this review

Hot path

Attributed requests (a user id on the request) now wait for one batched ledger commit before completing; unattributed requests are unchanged. Measured on the testbed (pg, pool 40, oha c=256, 3 interleaved reps, 5d44be7 vs 628c802): attributed small rps 52152 -> 60873 (+16.7%), p99 11.31 -> 5.47 ms; attributed big rps 28802 -> 30815 (+7.0%), p99 21.37 -> 11.10 ms; unattributed unchanged. Under saturation the old try_send path fell through to one single-row insert per request, so the batched wait is cheaper; on an idle gateway a single attributed request pays the batch commit (0.87 ms vs 0.17 ms). With the store down the wait is bounded by the ledger worker retry schedule (8 attempts, 100 ms doubling to 30 s) plus one direct write.

Follow-ups on the branch

• 5d44be7 the row ack carries the commit result; on a dropped batch the writer makes one direct write and only then hands the row to the best-effort repair queue; the three shutdown selects in drain_until fold into two helpers.
• d87a394 tests for the attributed fallback (paused tokio clock) and the drain shutdown path.
• 5fe45b4 only unacknowledged rows count as dropped.