wsl: terminate over COM, and stop demoting on service errors

[zcsizmadia]

Part of #356. Adds GetDistributionId and TerminateDistribution to the COM fast path — and records why Exec is not joining them, so the issue can be scoped honestly rather than left open on a hope.

Exec is not tractable

The issue and the existing code both suspected CreateLxProcess was the hard part. Reading the real signature in wslservice.idl settles it:

24 parameters, four returned sockets (stdin, stdout, stderr and a CommunicationChannel), a separate InteropSocket, a process handle and a server handle.

Driving that means reimplementing the relay and channel protocol wsl.exe already implements, against an interface whose stability Microsoft disclaims, for calls that are not on a hot loop. The spawn is the better trade. It is now stated in the Fast doc comment so nobody re-opens it hopefully.

This corrects a claim I made when proposing the sprint. I argued #356 would attack the remaining #398 start latency, because every Exec is 165 ms warm / 2,963 ms cold. That is not deliverable. The enabler argument still holds, and is stronger than I thought — see below.

The numbers, measured on this host

GetDistributionId          0.54 ms      (List, for scale: 0.66-0.81 ms)
Terminate over COM        10-16 ms
Terminate via wsl.exe       ~99 ms

~89 ms saved, all of it process spawn. The remaining ~15 ms is the service genuinely stopping the distro, which the CLI pays too. That is why this is 9× where List is 85×: List is a pure query, so spawn is the entire cost.

As latency this is marginal — Terminate runs on skrog stop and restarts, not in a loop, and 89 ms is under 2% of the 4.5–5.5 s start path. The real returns are error quality and GetDistributionId itself: every GUID-taking method needs that lookup, and it now exists at half a millisecond. #381 (ExportDistributionPipe, RegisterDistributionPipe), #382 (SetSparse, ResizeDistribution) and #383 (AttachDisk, MountDisk) all sit directly on it.

A bug the live test caught, that offline tests structurally could not

Terminating a distro that does not exist is the service answering, not the interface having moved. My first version treated it as the latter: it demoted COM for the rest of the process and re-ran the doomed operation through wsl.exe to produce a second, localised error.

before:  wsl --terminate skrog-no-such-distro: exit status 0xffffffff:
         There is no distribution with the supplied name.
after:   GetDistributionId: HRESULT 0x80040302

ServiceError now separates "the service replied with an error" from "the plumbing failed", and only the second demotes. The IID gate already covers slot correctness, so a call that came back at all is evidence the surface is intact, whatever it came back with.

Offline tests could not have found this: they exercise the fallback against a fake, and the fake has no opinion about what kind of error it returns.

Slot safety

Anchored on the one already proven. EnumerateDistributions is declaration 13 with three IUnknown methods ahead of it, so slot 15 — the existing constant, verified working against the live service. Counting from that anchor gives GetDistributionId = 6 and TerminateDistribution = 7. The IID gate covers these exactly as it covers slot 15.

The live tests assert the distro actually stopped, not that the call returned S_OK. A wrong slot would invoke a different method on a live object, and only a state assertion catches that.

Verified

• go test -tags wslcom ./internal/wsl/ against the real wslservice: terminate works and the state changes; an unknown distro produces an HRESULT with no fallback and no demotion; latency and the lookup/work split are logged.
• go test ./... and lint.ps1 green. Engine restored and running.

Leaving #356 open

Exec and Start were the bulk of the issue's ambition and are now explicitly out of scope with a reason. What remains worth doing under it is the rest of the GUID-taking surface, which #381/#382/#383 will pull in as they need it. Worth deciding whether to narrow the title or close it in favour of those three.