Make subscriber cleanup race-safe

[dallison]

Summary

• make subscriber disconnect cleanup authoritative by clearing unread delivery records, releasing every slot reference recorded in sub_owners, and retiring slots that become eligible after the subscriber count changes
• make publication, subscriber registration, and subscriber removal race-safe by keeping slots publisher-owned until delivery records are complete, rechecking membership around bitset writes, and deferring current-generation queue entries until commit
• align C++ and Rust shared-memory behavior with atomic subscriber counters, per-vchan cleanup generations, deduplicated retirement notifications, CCB v5, architecture documentation, and deterministic crash/race coverage

Test plan

• bazelisk test //client:client_test //rust_client:client_test //common:common_test //server:server_test //shadow:shadow_test //c_client:client_test
• bazelisk test //... --nocache_test_results
• git diff --check