fix(go)!: eliminate lifecycle deadlocks

[cunninghamcard-bit]

Problem

The Go binding held sync.RWMutex read locks across blocking C calls, which formed real wait cycles on master:

• TranscriptionSession.Close cannot reach the native abort while NextPart(-1) or a backpressured PushAudio holds the read lock — the two block each other forever.
• A full stream channel pins the blocking C stream call under the read lock, so a defer m.Close() after an early break out of Parts() waits for the write lock forever.

Router/MoA had the opposite defect: constructors read each child's handle under its read lock and released it before the C call, so a concurrent Close in that window freed a handle mid-construction — and the FFI then silently dropped that child, building a smaller composite than requested.

What changed — three commits

1. fix(ffi) — aimux_router_new / aimux_moa_new resolve every member under one registry lock and fail on the first unknown handle. Membership is all-or-nothing; MoA also rejects NULL references with ref_len > 0.
2. fix(go)! — every native owner (Model, ProviderHandle, the multimodal models, TranscriptionSession) becomes an atomic.Uint64 with 0 == closed. Calls snapshot the id and runtime.KeepAlive the owner until C returns; Close is Swap(0) + drop and never waits for Go state. Router/MoA snapshot ids in caller order — no multi-lock protocol. The stream producer keeps its structure and only stops holding a lock across the C call. This commit alone removes the deadlocks.
3. refactor(go) — stream internals: the producer goroutine is the sole writer of err and sole closer of Parts (the channel close is the publication point, so Err needs no lock); the handwritten callback registry is replaced by runtime/cgo.Handle; the cancelled channel/once/cause fields by context.WithCancelCause; the watcher goroutine by context.AfterFunc. The producer re-checks context.Cause after the C call returns so a cancellation landing during the last part is not lost. Typed and OpenAI adapters follow the same shape. No behaviour change beyond preserving the caller's cancellation cause.

Compatibility

Public Go method signatures and C ABI signatures are unchanged. Breaking for Go callers:

• Close is no longer a join/barrier. A racing call may finish, or receive the existing invalid-handle error.
• Stream.Err, TypedStream.Err, and OpenAIStream.Err must be read after Parts() closes; they no longer wait internally.
• Handle wrapper values must not be copied after first use (already unsafe with the embedded mutex; atomics make go vet flag it).
• Router/MoA now reject any invalid child/reference instead of silently dropping it.

Finalizers remain a best-effort leak fallback; callers still own explicit Close.

This PR intentionally contains no error-layering work, no new error classes, and no Node/Python changes. It keeps the current flat AimuxError*/sentinel ABI.

Verification

Each commit builds and passes on its own.

• cargo test -p aimux-ffi, cargo clippy -p aimux-ffi --all-targets -- -D warnings
• go build ./..., go vet ./..., go test -race -count=1 ./...
• deadline regressions: NextPart(-1) + Close, backpressured PushAudio + Close, full stream buffer Cancel + Model.Close, Close racing an in-flight ListModels / multimodal call
• repeated race coverage: duplicate / reversed Router and MoA construction against concurrent Close; zero-value Model; concurrent idempotent Close