Harden app runtime and thin export shell

docs/modernization/tasks.md

@@ -55,11 +55,9 @@ Key facts:
 - Raw `Node*` and callback captures remain a dominant UI lifetime risk.
 - `RTT`, `Texture2D`, `Shape`, `Shader`, `Font`, and `CanvasLayer` still route
   render work through `App::I` queues.
-- `AppRuntime` uses `std::jthread`, which is progress, but queue ownership,
-  running flags, thread affinity, and shutdown contracts are not yet component
-  contracts.
-- `PP_PANOPAINTER_APP_SOURCES` still includes `${PP_PLATFORM_WEB_SOURCES}`,
-  which should be removed in favor of concrete `pp_platform_web` ownership.
+- `AppRuntime` now owns synchronized running flags plus explicit post/reject,
+  same-thread execution, and queue-drain behavior, but broader singleton reach
+  and app-shell ownership remain.
 
 ## Parallel Assignment Rules