reapAll

Kill and drop every active eval, and any cleanup still owed — a revoke forbids it, and past a stop no pump is left to run it. Safe from any thread: drains concurrent queues; kill is idempotent. Two callers: an auth revoke (on the pump thread, which keeps pumping and so self-heals any straggler still compiling), and reapOnStop.