fix(redis): let the pump stop, and close the last four lines

The remaining four uncovered lines turned out to be two different problems, and
only one of them was about testing.

`migrate.rs:196` — `connection.begin()` failing — needs the connection dead at
exactly that call. Everything earlier in `apply_all` runs on the same connection
and would fail first, and the gap before it holds no await point a clock can aim
at. Timing cannot express "this statement and no earlier one"; the wire can,
because the statement names itself. The proxy now recognises `BEGIN` in
plaintext and drops the connection rather than forwarding it. No sleep, no retry.

`hub/pump.rs` 76/104/126 were not untested — they were unreachable because of a
DEFECT. `HubInner` owned the only command sender and `pump::run` holds an
`Arc<HubInner>` for life, so the pump was keeping its own wake-up signal alive:
`recv()` could never return None, and the pub/sub pump task could never
terminate. A process held a live Redis socket with no way to stop it, against
Invariant C2, with no stop path for §7's supervisor to join.

The sender moves off `HubInner` onto the handles that represent a caller's
interest. `release` takes it as an argument so the `Unsubscribe` send stays
INSIDE the locked region — an `Unsubscribe` overtaking the `Subscribe` of a
reader arriving on the same channel would leave that reader subscribed to
nothing. A `Weak` in the pump was the other candidate and was rejected: its
failed-upgrade arms are branches reachable only in a narrow race, so it would
have closed three uncovered lines by adding three more.

The new test counts connections server-side. A client-side assertion could only
say the hub stopped being used; only the server can say the socket closed. It
also holds the half that is easy to break: a reader outliving the hub keeps its
connection, because a `Subscription` is a handle too.

Workspace 100.00% (3193/3193). Nothing is named under codecov.yml's escape
clause and the number did not move.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>