refactor: apply idiomatic C# safety fixes across SDK

Phase 3 of refactor-plan.md.

The plan §6 violation scan claimed ~22 awaits missing ConfigureAwait
and 3+ public-async sites missing CancellationToken; on a second
pass with a multi-line-aware scan, those are false positives — all
85 awaits in src/ already call ConfigureAwait(false), and the
3 public-async sites already accept a CT. AgentRegistry.Versions
was flagged as a Tier-1 mutable-collection leak; it's a property on
a private nested class, so it's never on the public surface.

Real changes:
- SessionState.RunAsync now accepts a CancellationToken and links
  it to the internal CTS. ArcpServer.AcceptAsync forwards its own
  token through (fixes CA2016 that surfaced from the signature
  change).
- ArcpClient.ReaderLoop: replace empty `catch (OperationCanceledException)`
  with a one-line justification comment.
- ArcpClient.DisposeAsync: replace bare `catch { }` with typed
  `catch (Exception)` + comment.
- Samples SubmitAndStream / LeaseViolation: forward `ct` through to
  context calls to clear the three lingering CA2016 warnings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nficano

samples/LeaseViolation/Program.cs

@@ -25,7 +25,7 @@
         {
             Code = ex.Code,
             Message = ex.Message,
-        });
+        }, ct);
     }
     return "scan-complete";
 });

samples/SubmitAndStream/Program.cs

@@ -12,9 +12,9 @@
 });
 server.RegisterAgent("greeter", async (ctx, ct) =>
 {
-    await ctx.StatusAsync("starting");
+    await ctx.StatusAsync("starting", cancellationToken: ct);
     await ctx.LogAsync("info", $"Hello, {ctx.Input}!", ct);
-    await ctx.StatusAsync("complete");
+    await ctx.StatusAsync("complete", cancellationToken: ct);
     return new { greeting = $"Hello, {ctx.Input}!" };
 });
 

src/Arcp.Client/ArcpClient.cs

@@ -97,7 +97,10 @@ private async Task ReaderLoop(CancellationToken cancellationToken)
                 Dispatch(env, cancellationToken);
             }
         }
-        catch (OperationCanceledException) { }
+        catch (OperationCanceledException)
+        {
+            // Expected on shutdown; reader loop exits silently.
+        }
         catch (Exception)
         {
             // Surface as a session error to in-flight handles.
@@ -303,7 +306,10 @@ await _transport.SendAsync(new Envelope
                 Payload = new SessionByePayload { Reason = "client_close" },
             }).ConfigureAwait(false);
         }
-        catch { /* already closed */ }
+        catch (Exception)
+        {
+            // Transport may already be closed; suppress on dispose path.
+        }
         _cts.Cancel();
         await _transport.DisposeAsync().ConfigureAwait(false);
         _cts.Dispose();

src/Arcp.Runtime/ArcpServer.cs

@@ -60,7 +60,7 @@ public async Task AcceptAsync(ITransport transport, CancellationToken cancellati
         _sessions[session.SessionId] = session;
         try
         {
-            await session.RunAsync().ConfigureAwait(false);
+            await session.RunAsync(cancellationToken).ConfigureAwait(false);
         }
         finally
         {

src/Arcp.Runtime/SessionState.cs

@@ -63,20 +63,22 @@ internal SessionState(ITransport transport, ArcpServer server, ArcpServerOptions
         _lastInboundAt = options.TimeProvider.GetUtcNow();
     }
 
-    public async Task RunAsync()
+    public async Task RunAsync(CancellationToken cancellationToken = default)
     {
-        var sender = Task.Run(() => SenderLoop(_cts.Token));
-        var heartbeat = Task.Run(() => HeartbeatLoop(_cts.Token));
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(_cts.Token, cancellationToken);
+        var token = linked.Token;
+        var sender = Task.Run(() => SenderLoop(token), token);
+        var heartbeat = Task.Run(() => HeartbeatLoop(token), token);
         try
         {
-            await ReceiverLoop(_cts.Token).ConfigureAwait(false);
+            await ReceiverLoop(token).ConfigureAwait(false);
         }
         finally
         {
             _cts.Cancel();
             _outbound.Writer.TryComplete();
-            try { await sender.ConfigureAwait(false); } catch { /* shutdown */ }
-            try { await heartbeat.ConfigureAwait(false); } catch { /* shutdown */ }
+            try { await sender.ConfigureAwait(false); } catch (OperationCanceledException) { }
+            try { await heartbeat.ConfigureAwait(false); } catch (OperationCanceledException) { }
             IsClosed = true;
             _server.RemoveSession(this);
         }