feat(ipc): unify connection handles into poll selector ids (server push)

[singaraiona]

Problem

A user hit this on 2.1.0:

‣ (set .ipc.on.open (fn [h] (.ipc.post h "(+ 1 1")))
lambda
‣ ipc: .ipc.on.open hook raised an error (handle=2)

Posting on the handle a hook receives always failed — inside the hook and later with a stored handle. Root cause: two disjoint handle namespaces. .ipc.open returned an index into a private client fd table (g_client_fds[]), while hooks received the inbound connection's poll selector id. .ipc.send/.ipc.post/.ipc.close only consulted the client table, so server-side handles never resolved — and since both namespaces are small integers, a server with its own outbound connections could even deliver to the wrong peer silently.

Change

A handle is now one thing: the poll selector id of an IPC connection, inbound or outbound.

• ray_ipc_connect does the blocking handshake/auth as before, then hands the socket to the active poll with the same read pump inbound connections use, returning the selector id. The client fd table is deleted.
• .ipc.send / .ipc.post / .ipc.close resolve any handle in the active poll (thread-local poll of the dispatching hook/eval, else the runtime's main poll). Hooks can push through — or close — the handles they receive, kdb-style (neg[h] analog). Resolution validates the target is a handshake-complete IPC connection, so a stray integer can't write to the listener, stdin, or a mid-handshake socket.
• .ipc.send now pumps the connection while waiting for its response: interleaved pushed asyncs are dispatched, and sync requests from the peer are answered — full duplex. This also fixes a latent corruption bug: the old response reader never checked hdr.msgtype, so a pushed frame would have been consumed as the next sync response.
• ipc_read_payload detaches the payload buffer and advances the state machine before evaluating, making nested round-trips on the same connection re-entrancy-safe; RESP frames are deposited for the waiting sender instead of being evaluated.
• Lifecycle hooks remain inbound-only, preserving the documented on.open/on.close 1:1 pairing.

Behaviour notes

• Wire format unchanged; old and new peers interoperate.
• .ipc.open handle values shift (selector ids instead of table indices) — they were always opaque.
• Idle interactive/server processes dispatch pushes via the poll loop; script-mode clients drain them during their next .ipc.send wait.
• Selector ids are reused after close (like kdb fds): don't cache handles past on.close. A generation tag could harden this later.
• A corrupt compressed request now produces a null response instead of leaving the sync caller hanging.

Tests

• New ipc/server_push test: push from inside .ipc.on.open and push later through a stored handle, delivered across a real round-trip.
• Test fixtures (test_ipc.c, test_store.c, test_repl.c, .rfl runner) now publish a runtime poll, mirroring main.c.
• syscmd_coverage.rfl updated: its .sys.listen → nyi assertions relied on the test runner having no poll; valid ports now genuinely bind, so it asserts the success and double-bind io branches instead.
• Full suite under ASan/UBSan: 3375 of 3377 passed, 2 skipped, 0 failed.
• Verified end-to-end with two processes: hook-installed push and out-of-hook push both delivered and evaluated client-side.

Fixes the reported async-IPC-from-server bug.