safety: document + implement an explicit fleet kill switch

[lorenzoliuzzo]

Part of the fleet milestone (#1 §4).

Gap

The kill switch is implicit. fleet_dispatch.py defaults to --dry-run
(good), but there's no single documented command to halt an in-flight --execute
run across both accounts if something misbehaves.

Do

• A one-line runbook: how to stop everything now (signal, marker file, or
  flag the workers poll).
• Better: a real --abort that stops launching, lets in-flight sessions end
  cleanly (or cancels them), and leaves branches/ledger consistent.

Acceptance

A documented, tested abort path; running it mid-flight leaves no half-written
state.