ProgressListener: enforce 'process-wide' invariant across SetListener swaps

[gagelarsen]

Follow-up from issue #116 (review finding #11).

xmscore/misc/Progress.h:43-69 — ProgressListener::SetListener(BSHP<ProgressListener>) is documented as installing the process-wide listener, but does not handle the mid-flight swap case: a Progress constructed against listener A and destructed after SetListener(B) will pop the wrong stack.

Proposed change

Pick one (or both):

1. Reject mid-flight swaps: have SetListener assert / throw when the current stack is non-empty.
2. Capture by weak_ptr at Progress construction: the destructor pops on the listener that allocated the slot, regardless of intervening SetListener calls. If the listener is gone, the pop is a no-op.

Document whichever policy is chosen in the new \brief.

Why follow-up, not part of #117

The new \brief in #117 commits to "process-wide" semantics that the type doesn't currently maintain. Implementing that contract is a behavioral change, not a doc edit.

Acceptance

• Mid-flight SetListener either fails loudly or is provably safe
• CxxTest covers: (a) construct-against-A, swap-to-B, destruct ordering; (b) listener replaced with null while a stack is non-empty
• Documented policy matches enforcement

Refs: issue #116, PR #117.