Recreate expired UDP sessions without losing the first datagram

[szonov]

When a UDP stream is dropped, its sender can remain in the session table until the asynchronous destroy notification is processed. A datagram arriving in that interval is sent to a closed receiver and lost. This is the scenario reported by @ple1n in #81, which also links the implementation used by nsproxy.

Recover the undelivered packet from SendError, remove the dead entry, and create a replacement stream with that packet as its first payload. Keep the existing asynchronous cleanup, but remove an entry on a destroy notification only if its current sender is closed. This prevents an old stream's delayed notification from deleting a live replacement.

Extract the existing registration path so initial and replacement streams use the same setup. Extract the removal handler used by the event loop so the deterministic race test exercises production cleanup code rather than repeating its condition.

Fixes #81.

Tests

• dead_udp_session_preserves_payload_and_survives_stale_removal: closes a stream, queues its destroy notification, dispatches the next datagram before applying that notification, reads and checks its complete payload, runs the production removal handler, and checks the next datagram still reaches the same replacement. Finally checks cleanup of the replacement itself.
• stale_udp_removal_does_not_remove_a_live_session: independently catches unconditional removal of a live sender.
• dropped_udp_session_is_cleaned_without_more_traffic: runs the real IP-stack event loop with an in-memory device and verifies that dropping a stream releases the table's sender without more device input.
• expired_udp_session_is_cleaned_without_more_traffic: checks the same cleanup after the configured inactivity timeout is observed and the caller drops the expired stream. Uses Tokio's paused clock.

On unpatched upstream, the first two tests fail: dispatch returns SendError, and the stale notification removes the live entry. The two cleanup tests also protect existing cleanup behavior from regressions; they pass before and after the fix.

Validated on upstream 44bb34fe50bd9c04290b4b4f9bbeece1626a95d4 on macOS arm64 with Rust 1.99.0:

• cargo fmt -- --check
• cargo test --offline --locked: 40 unit tests and 23 documentation tests pass.
• cargo clippy --offline --locked --all-targets -- -D warnings

The same commit and Cargo.lock were also validated on Linux ARM64 (Debian 12, Rust 1.98.1): all 40 unit tests and 23 documentation tests pass, as do formatting, Clippy with all targets/features and -D warnings, and the examples/tests build. Checks ran offline in a container with networking disabled.

No changes to dependencies or public APIs. No live TUN/network test was performed.

Native Linux AMD64 validation also passes on Debian 13 with Rust 1.98.1, using the same commit and Cargo.lock: 40 unit tests, 23 documentation tests, formatting, Clippy for all targets/features with -D warnings, and the examples/tests build.