[thomhurst]

When node shutdown cancels an in-flight leadership-lock acquisition, DoHealthChecksInternalAsync currently logs it as an Error. Handle OperationCanceledException when the controller's lifetime is canceled, then return the normal empty command result. Independent cancellation while running and ordinary lock failures during shutdown retain the existing error path.

Closes #5253

Validation:

• TDD: the shutdown regression fails before the fix with TaskCanceledException; all three discriminating tests pass afterward on .NET 10 and .NET 9.
• Standalone reproduction against released 6.56.0 fails identically twice, without a database or broker.
• Full dotnet build wolverine.slnx -c Release -f net9.0 succeeds (one sample-project assembly-cache file contention warning).
• Full .NET 10 CoreTests: 3,923 passed, 3 failed, 8 existing skips. The three failures are multiline assertions in event_model_scaffold_4832; a clean detached checkout of untouched main reproduces those exact three failures (61 passed, 3 failed, no skips in that class).
• Log sweep distinguishes intentional fault-injection errors from an unrelated Windows EventLogInternal disposed-provider failure observed during the full suite. The focused regression logs no unexpected errors.

The change does not alter shutdown ordering, lock ownership, or error severity for genuine failures.