android: harden detached connect timeout gate (refactor branch port of #8696)

[myleshorton]

Cherry-pick of #8696 (8998d94ac) onto the refactor branch.

The refactor branch already includes #8689 (0540dc9ab), which introduced the connectInFlight single-flight gate with the try { connect() } finally { connectInFlight.set(false) } pattern. That pattern leaves the gate permanently wedged if the coroutine body never starts (pre-dispatch cancellation) — after which every future connect attempt is rejected with IllegalStateException until the process is killed.

#8696 moves the reset to deferred.invokeOnCompletion { ... }, which fires on every terminal Deferred state, including immediate cancellation. Happy path and JNI-still-running timeout path are unchanged.

Clean cherry-pick, no conflicts. Diff is identical to what landed on main.

Test plan

• Android build passes on refactor
• Covered by same manual reproduction as android: harden detached connect timeout gate #8696 (connect / timeout / retry)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR cherry-picks the main-branch fix from #8696 onto the refactor branch to prevent the Android VPN connectInFlight single-flight gate from getting stuck when the async coroutine is cancelled before its body starts (pre-dispatch cancellation).

Changes:

• Move connectInFlight reset from an async { try/finally } block into deferred.invokeOnCompletion { ... } so the flag clears for all terminal Deferred states (including immediate cancellation).
• Update the surrounding comment to reflect the new reset mechanism and the “early cancellation” wedge scenario.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.