Make it impossible to mark an operation as killed without holding the Client lock

The comment for ServiceContext::killOperation says that callers must be holding the Client lock before calling it. It would be helpful if the API for killOperation made it impossible to call without holding the Client lock, to avoid subtle programming errors.