Tests: close protocol/auth/concurrency coverage gaps + fix testNoAttach race + harden error semantics

[Tagar]

This PR closes several concrete test-coverage gaps and fixes the testNoAttach flake. Along the way the new tests surfaced three small semantic gaps in protocol.py / java_gateway.py; those are folded in as part of the same coherent change.

Test coverage added

• Protocol containers + malformed wire format (protocol_containers_test.py, new) — round-trip on list/dict/set get_command_part encoding (pinning that plain Python containers correctly raise AttributeError and need JVM-side conversion via java_collections.ListConverter); Py4JError semantics for unknown type codes / truncated answer / error marker.
• Decimal edge cases (protocol_test.py::DecimalEncodingTest, 4 tests) — high-precision survival; Decimal("Infinity") and Decimal("NaN") encode verbatim into the wire output, NOT silently corrupted.
• String escaping boundaries (protocol_test.py::StringEscapingEdgeCasesTest, 7 tests) — UTF-8 (CJK + emoji), CRLF, consecutive backslashes, null bytes, empty string, only-special-chars. Pins behavior before any future unescape_new_line rewrite.
• Auth failure paths (client_server_test.py::AuthFailureTest, 3 tests) — wrong token / missing token / oversized token (4096 chars) → Py4JAuthenticationError on first JVM access.
• Concurrent gateway usage (concurrent_gateway_test.py, new) — tiered with @pytest.mark.slow: 16-thread × 50-call quick variant on every CI cell, 100-thread × 1000-call stress variant gated for workflow_dispatch only. Uses threading.Barrier(timeout=60) for deterministic lockstep + safe_join for bounded teardown.
• ThreadSafeFinalizer race (finalizer_test.py::ThreadSafeFinalizerRaceTest) — same tiered approach; concurrent add + clear pressure.
• JVM crash mid-call (client_server_test.py::JVMCrashRecoveryTest) — Popen.kill() the JVM, next call must raise (Py4JNetworkError, Py4JError, ConnectionError, OSError) within a bounded read_timeout=5.0 (no hang). Tight exception list — no Exception catch-all.

Race / semantic fixes folded in

• testNoAttach race fix — replaces the prior assertRaises that flaked on macOS Python 3.13 + Java 17 (1-in-N) with a deterministic socket-close probe (poll until connect() is refused, bounded 5s). The async listening-socket close after shutdown() is the race; the probe makes the precondition explicit.
• get_return_value Py4JError semantics (production fix in protocol.py) — wraps OUTPUT_CONVERTER[type_char] lookups in try/except KeyError → Py4JError and adds a len(answer) < 2 guard so truncated responses surface as Py4JError, not bare KeyError / IndexError. Surfaced by MalformedWireFormatTest.
• Missing-token → Py4JAuthenticationError (production fix in java_gateway.py) — GatewayConnection.send_command detects Java-side AuthCommand error responses ("Authentication error" substring on an ERROR + STRING_TYPE prefix) and raises Py4JAuthenticationError instead of letting the generic Py4JError path catch it. Required for the missing-token negative test; closes a latent bug where auth_token=None produced the wrong exception class.

Pytest config

Adds setup.cfg with the slow marker registered for @pytest.mark.slow gating.

Out of scope (deferred)

• SSL/TLS cert validation tests (needs test fixtures).
• Callback-server accept-timeout under load (needs harness).
• Signals concurrent-dispatch tests (lower priority).
• unescape_new_line state-machine rewrite (gated on this coverage landing — separate perf PR).
• Extracting the "Authentication error" magic string to a named constant (follow-up; current behavior is correct, just couples to the Java-side string).

Co-authored-by: Isaac

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing tests-and-race-fixes (0b9c46f) with master (899ee0d)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩