Stop and join the native worker away from the caller's dispatcher.
A teardown failure is propagated and leaves shutdown retryable. The host must not close or delete the account database until this call succeeds.