Broker exit request and nix run .#loop for self-updating hosts

- broker: `{"type":"exit"}` answers `exiting`; `sausage run` then stops all
  actors and exits with code 75.
- flake: apps `loop` / `loop-internal` run `nix run --refresh git+ssh://.../surma/sausage -- run <world>`
  in a loop; exit code 0 (/quit) ends the loop, anything else restarts.
- PROTOCOL.md, README.md, test in cli/tests/host.rs.

Not compiled: written by the Sausage agent, which cannot build the native host.

PROTOCOL.md

@@ -83,7 +83,7 @@ message.
 Requests to `broker`. The answer is a message whose `reply_to` is the ID of
 the request: the request's `type` in past tense (`spawned`, `upgraded`,
 `rolled_back`, `stopped`, `started`, `subscribed`, `unsubscribed`,
-`scanned`), or `{"type": "error", "reason": "..."}`.
+`scanned`, `exiting`), or `{"type": "error", "reason": "..."}`.
 
 | `type` | Fields | Effect |
 | --- | --- | --- |
@@ -93,6 +93,7 @@ the request: the request's `type` in past tense (`spawned`, `upgraded`,
 | `stop`, `start` | `actor` | stop or start an actor |
 | `subscribe`, `unsubscribe` | `actor` | receive (or not) what `actor` publishes |
 | `scan` | | boot new or changed `actor.wasm` files |
+| `exit` | | answer `exiting`, stop every actor, and end the `sausage` process (a wrapper like `nix run .#loop` starts it again, updated) |
 
 Paths are `/actor/...`, or the sender's `/public/...` or `/data/...`.