Transfer proxy tunnel socket ownership

[samuel-williams-shopify]

Summary

• make Async::HTTP::Body::Pipe#to_io a documented, one-shot transfer of the tail socket
• return an ordinary socket from Proxy#connect, with no callback or reference into its originating Async context
• explicitly close both the socket and forwarding pipe when Proxy#connect is used with a block
• verify that a second to_io call fails explicitly and that closure from another thread is observed through the socket pair
• document the lifecycle change in the unreleased notes

Proxy#connect returns an IO which may outlive or leave the thread or execution context that created it. Calling back into the pipe from Socket#close would therefore share mutable Async state across contexts, and Ruby IO autoclose does not invoke a Ruby-level close override.

Body::Pipe#to_io now transfers ownership and clears the pipe reference to the returned socket. It may only be called once; subsequent calls raise IOError. The caller exclusively owns that IO, so it can close normally or be automatically collected. The forwarding tasks observe EOF and write failures through the Unix socket pair and close their respective HTTP bodies. Cleanup is consequently eventual rather than an unsafe synchronous callback into the originating task.

The block form retains deterministic scoped cleanup because the proxy still owns both values for the duration of the block.

This complements #244: transient CONNECT tasks do not keep the creator alive, while the returned socket is not retained by those tasks.

Verification

• bundle exec sus test/async/http/body/pipe.rb test/async/http/proxy.rb (34 passed)
• bundle exec bake test (259 passed, 3 skipped)
• bundle exec rubocop (135 files, no offenses)
• COVERAGE=PartialSummary BUNDLE_WITH=maintenance bundle exec bake decode:index:coverage lib (293/293)