feat: handle service terminate with per-capability persistence

Reject terminate when the instance is already terminating/terminated
or the caller is not the app provider. After each successful deactivate,
commit that capability as TERMINATED so a later failure cannot roll
earlier successes back.