Surface a dead channel to subscribers; refuse attaching unlinked SHM (#272)

[cboulay]

Restacked: ported onto #268. A channel can now fail in _reattach_shm (which aborts) or in frames_available (caught by FramedProtocol._drain_frames, kept as _close_exc, then aborted); both end in ChannelProtocol.connection_lost, which records the failure, and _on_disconnected notifies subscribers. New test test_a_channel_crash_reaches_the_subscriber makes delivery raise and checks the subscriber gets ChannelFailed chained from it.

Part of #272. Draft, pending review (Griff). Stacked on #276.

The uncontroversial parts of the original #273 moved to #275 (tolerant SHM close, wait_closed leak, read-only SHM messages, and the grow-race fix). What's left here implies policy choices, so it's held for review.

Changes

• Surface channel death. A crashed _publisher_connection records the exception and notifies its clients. Subscriber.recv_zero_copy() raises a new ChannelFailed, chained from the cause, instead of waiting forever. In a unit, handle_subscriber logs it at ERROR and keeps serving the stream's other publishers.
• Refuse attaching an unlinked segment. SHMInfo marks itself unlinked when its last lease ends (and never unlinks twice). The GraphServer forgets such entries, both on a late SHM_ATTACH and as a sweep on SHM_CREATE. A late attach is then refused (ValueError, which the channel already treats as a stale generation) instead of succeeding on the server and failing on the client with FileNotFoundError.
• Channel treats FileNotFoundError on attach as stale too, for older GraphServers.

With #275's deferred close, a publisher no longer retires a segment a channel still needs, so the last two are defensive.

Open questions

1. What ChannelFailed should do in a unit: currently log and keep serving other publishers. Alternatives: end the subscriber when none remain, mark the shutdown unclean, or reconnect the channel.
2. Stale-generation drops: when a channel does see a stale segment, it drops that message (existing behaviour). Is that acceptable, or should the publisher guarantee delivery across generations?

Tests

• test_subclient.py::test_recv_zero_copy_raises_channel_failed
• test_shm.py::test_attaching_an_unlinked_segment_is_refused (fails without the GraphServer change)

Full suite: only the 10 test_settings_json_schema / test_inspect_command failures that also fail on the base branch. test_shm_resize_race_repro_completes and the grow tests pass 6/6. The earlier hang came from losing the grow race, which #275 now fixes.