Run-scoped control surface for cooperative draining.
Intended for a single graph run. Create a fresh RunControl per run;
reusing a control after request_drain() leaves it drained.
Safe to call from any thread: the drain request is represented by a single attribute write, so no lock is needed for this signal. If more mutable state is added here, add synchronization.
