fix(hub): close transport after IO loop to prevent sub-agent process leak

[yishuiliunian]

Summary

• Sub-agent processes (loopal --serve) hung indefinitely after completion due to a stdin pipe deadlock: the Hub never closed its write end of the child's stdin, so tokio::io::stdin()'s blocking read never received EOF
• Observed: 37 zombie-like processes (32KB RSS, 23+ hours) under a single parent, confirmed via lsof that pipes were still open
• Root cause: mutual deadlock — Hub waits for child exit (agent_proc.wait()), child waits for stdin EOF (blocking thread, uncancellable per tokio docs)

Changes

• finish.rs: Move conn.close() into finish_and_deliver — closes transport writer after emit/unregister/delivery, giving the child EOF on stdin
• agent_io.rs: Pass conn to finish_and_deliver; remove standalone conn.close() calls from spawn_io_loop and start_agent_io
• connection.rs: IPC reader task breaks on tx.send() failure instead of silently continuing when incoming channel is dropped
• process.rs: Add AgentProcess::wait_or_kill(timeout) utility for bounded process reaping (not yet wired into default path)
• transport_close_test.rs: 5 tests — transport disconnect, EOF propagation, result-before-close ordering, child crash path, registry cleanup
• reader_exit_test.rs: 1 test — reader task exits and releases Mutex after channel drop

Test plan

• bazel build //... compiles
• bazel build //... --config=clippy zero warnings
• bazel test //... — 50/50 pass
• CI passes