Fix SIGSEGV on failed startup: do not join the api service thread when it was never started

[Buell (JanZachmann)]

Fixes #911

What

uninit_api_svc() joined g_api_svc_thread unconditionally. The handle is
zero-initialized and only set by init_api_svc(), so a shutdown that never started
the service passed a NULL thread descriptor to pthread_join(). On aarch64 glibc
that dereferences it and the agent dies with SIGSEGV (fault address 0xd0, inside
the join implementation); x86 glibc happens to return ESRCH, so the crash only
shows on arm.

The agent hits this on every failed startup: HealthCheck() fails, main() goes to
done, ShutdownAgent() calls uninit_api_svc() although StartupAgent() never
ran. The unit restarts the agent after the failure, so the crash repeats until the
start limit stops the service.

Fix

Take the running flag with atomic_exchange() and skip the teardown when it was
already false. A second uninit_api_svc() is a no-op too, matching the guard the
timer thread already has in _stop_thread() (timer_utils/src/timer.c).

Tests

• New sections in apisvc_unit_tests.cpp: "uninit without init" and "uninit twice".
  They interpose pthread_join() (real handles forwarded to libc via
  dlsym(RTLD_NEXT, ...)) and assert that no join is attempted on the zero handle.
  A plain return-value check would not catch the bug on x86, where the faulty join
  just returns ESRCH.
• apisvc_unit_tests: 26/26 assertions pass with the fix; 2 assertions fail without
  it.
• Full ctest run on develop: the failing-test set is identical before and after
  this change (80 pre-existing failures in my container setup, none in apisvc).

Root-caused from a symbolized device core; details in #911.