withServer

Open one handle, run the callback, then perform bounded owned cleanup. Cleanup never replaces a callback exception. Incomplete cleanup raises CleanupFailed after success, or annotates the original callback failure with a reachable CleanupRecovery. No daemon shutdown is requested.