Broker exit request and nix run .#loop for self-updating hosts

- broker: `{"type":"exit"}` answers `exiting`; `sausage run` then stops all
  actors and exits with code 75.
- flake: apps `loop` / `loop-internal` run `nix run --refresh git+ssh://.../surma/sausage -- run <world>`
  in a loop; exit code 0 (/quit) ends the loop, anything else restarts.
- PROTOCOL.md, README.md, test in cli/tests/host.rs.

Not compiled: written by the Sausage agent, which cannot build the native host.

cli/tests/host.rs

@@ -127,6 +127,18 @@ async fn broker_does_not_answer_messages_with_reply_to() {
     host.stop().await;
 }
 
+#[tokio::test]
+async fn exit_request_is_answered_and_signals_the_host() {
+    let world = create_world("broker-exit");
+    let (host, mut mailbox) = start(&world).await;
+    let exiting = request(&host, &mut mailbox, json!({"type": "exit"})).await;
+    assert_eq!(exiting.body["type"], "exiting");
+    tokio::time::timeout(Duration::from_secs(1), host.broker.exit_requested())
+        .await
+        .expect("exit request did not reach the host");
+    host.stop().await;
+}
+
 #[tokio::test]
 async fn filesystem_permissions_and_public_sharing() {
     let (_, host, mut mailbox) = filesystem_world("filesystem-permissions").await;