Add graceful SIGINT and SIGTERM worker shutdown

[eamsden]

Worker examples currently use Worker::run(), so SIGINT and SIGTERM terminate the process without initiating worker shutdown. Add opt-in Worker::run_until_signal() and use it in the worker examples and getting-started documentation. On Unix, both signals initiate the existing shutdown path and await the worker result, allowing activity completion and cleanup to follow the configured grace period. Windows uses Ctrl-C.

Applications retain control of their signal policy through run() and shutdown_handle(). The helper owns and drops its signal receivers without spawning a signal task; the API docs explain Tokio's persistent process-wide signal handlers and existing future cancellation semantics. Registration failures use a typed worker error. Includes a Rust SDK changelog entry.

Related to #1637: this follows the existing run() lifecycle; the application-owned shutdown future and consuming Core finalization remain in that separate PR.

Validation on macOS with the repository's Rust 1.94 toolchain:

• cargo +nightly fmt
• cargo lint
• cargo test-lint
• cargo test --features experimental — workspace tests and doctests passed. Tests requiring local sockets/native certificates were run outside the sandbox.
• timeout 180 cargo integ-test -s external -- worker_signal --nocapture — 6 passed. Subprocesses receive real SIGINT/SIGTERM and verify activity draining, cancellation after grace expiry, cleanup, completion reporting, shutdown hooks, and drained polling queues. Also verifies explicit shutdown and validation failure without a signal. No Temporal server is required for these tests.
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps

Windows runtime behavior and the full server-backed integration suite were not tested locally; the existing CI matrix covers Windows and both Unix platforms.