OperationContext::markKilled requires the client lock, but there's nothing in the actual API to prevent a user from calling it without the client lock. ServiceContext::killOperation on the other hand at least requires a WithLock parameter to make it somewhat more obvious. But then the existence of both of these functions makes me wonder whether ordinary users of OperationContext should even be able to call markKilled or whether we should only use the ServiceContext function.

This is part of a broader issue I see which is that we should properly encapsulate the Client lock so that this isn't even an issue. After discussion with the team we might decide to turn this into a broader ticket to do that work instead.

Acceptance criteria:

• It is impossible to call OperationContext::markKilled without the Client lock