Specify and re-implement exit procedure. #474

The exit procedure is untested and underspecified.

The docs say “Exits the running Fusion program” but the implementation just throws an exception in the current thread.

In Racket, exit abruptly terminates the process after flushing the original plumber.

In Fusion, especially for embedding cases, that's too aggressive, at least for default behavior. I think “abort this thread" makes sense in that context.

Still, I'm suspicious that the implementation may not exit as abrubtly as possible. Can the exception be intercepted and handled from Fusion code? From Java code? This may need special handling in the runtime.

The existing ExitException API is a sensible signal to the application, but perhaps that should just be an outer-layer thing, not the implementation.