Supervise sampler and ownership-query commands through physical exit on cancellation. Share Darwin helper command ownership, reject new commands after close starts, and drain admitted commands before removing the root. Keep failed root cleanup retryable without rerunning completed queries. Fixes #5199 Fixes #5202