serve: check every server→engine frame write and drop the pending entry when one fails

[monotophic]

Authored by Claude Fable 5.1 in Claude Code, analysis in partnership with @monotophic

The server writes SUBMIT, IMAGE, CANCEL and STOP frames to the engine's stdin without
looking at the result. A short write leaves the tail of a frame unsent and desynchronises the
engine's framing; a BrokenPipeError is a ConnectionError subclass, so it falls into the
client-hangup handler and the client sees a silent close instead of an error. This checks every
write and names the failure.

What changes. A small _write_all loops on short writes over a memoryview and fails closed on a
None or zero return. CANCEL and STOP go through Engine._write_frame, which drops the request's
pending-map entry on any failure and then raises: an OSError becomes a named RuntimeError, and
_write_all's own fail-closed error passes through; the SUBMIT and
IMAGE writes use the same checked loop inside the existing block, under the same single lock
acquisition, in the same order. A failed write while the response is uncommitted is an HTTP 500
engine_error; on a committed stream it ends the stream with one status line and nothing spliced
in.

What does not change. Every frame the server writes is byte-identical to dev, in the same
order, for plain, image, cancel and stop requests; three tests pin those sequences and pass on
dev. Engine.generate()'s signature is unchanged. A raise inside a decode callback still leaves
the pending entry behind, as on dev; this change covers failed writes only.

Tests (c/tests/test_openai_server.py, run from c/): fifteen added. WriteAllTest (four: a short
write reassembled whole, a short first write answered with the correct remainder, and the None and
zero returns that fail closed), PendingMapCleanupTest (four: a failed CANCEL, STOP and IMAGE,
and a CANCEL that fails with no OSError at all, a zero-byte return), WriteFailureHTTPTest
(four: a dead engine at SUBMIT on the non-streaming and
the streaming chat paths, a STOP failing before commit, a STOP failing on a committed stream), and
PlainRequestFrameOrderTest (three frame pins: the stop flow, the cancel flow, and IMAGE before
SUBMIT under one lock acquisition). Eleven fail on dev;
the three pins and the committed-stream test pass on dev by design, the last because dev already
ends the stream, only without the guarantee. test_openai_server.py and test_anthropic_messages.py:
240 green; test_openai_server.py wall time 24.2 → 24.3 s, no new test over 0.30 s.

Limits. A frame that was partly written before the failure stays on the pipe; nothing here
restarts or quarantines the engine, and a later request on that engine gets whatever the engine
makes of the partial frame. On dev the same failure left the request waiting for a reply the engine
would never send; here it is a named error.

Context. This is split out of #1353, which is being reduced to its logprobs/echo work. The
two are independent in behaviour. They meet in two places: both add module-level code just above
class Engine, and both append to the end of the test module, so whichever lands second takes a
small rebase there.