[TENT] Bound the pending-batch drain wait in ProxyManager shutdown (#3526)

* [TENT] Bound the pending-batch drain wait in ProxyManager shutdown

deconstruct() waits for in-flight staging batches to reach a terminal
state with no upper bound; if a peer dies and the transport timeout
never fires, shutdown hangs forever. Bound the drain wait and fall
through to the existing remaining-path handling (leave the cleanups
pinned with a warning) once the deadline passes.

The timeout makes the remaining path reachable with non-terminal
batches (previously impossible), so extend its keep-pinned guard to
cover pending batches too, matching the DMA-safety intent of #3380.

* ci: re-trigger (test-wheel jobs were cancelled)

* [TENT] Defer undrained staging teardown until transports quiesce

Per review: a timed-out drain must not free resources the transport
workers can still touch. Move the undrained pending cleanups, their
batches, and the backing local stage buffers into a deferred holder
owned by TransferEngineImpl, released only after transport.reset()
joins the workers and drains the CQ. Remote pins stay held as before.
Adds a regression test with a never-completing fake transport.