The hardened callable returned by IResilienceService.wrap.

The signal is optional: guarded() behaves exactly as before, while guarded(signal) additionally lets the caller cancel from outside — the outer abort propagates into the protected call, stops the retry loop, and rejects a waiter still queued behind the bulkhead.