fix(server): tie the liveness probe to the server generation and classify read errors

Addresses both review comments on #156:

- The probe now carries the connection generation it was launched for plus a
  CancellationTokenSource cancelled by StopServer(), and re-checks currency
  before every side effect (settle-wait, per-address loop, both log sites) -
  a probe that slept or blocked in Read() across a server replacement exits
  silently instead of reporting a stale verdict against a healthy successor.

- IOException from NetworkStream.Read() is no longer treated as proof of
  death: the inner SocketException is inspected and only SocketError.TimedOut
  triggers the dead-server diagnostic. Resets/aborts (an ordinary
  shutdown/restart race) stay silent, consistent with the probe's existing
  ambiguous-evidence-stays-silent doctrine.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>