Release pooled connections when their borrowing coroutine exits

[adhikjoshi]

Problem

Worker::handle() only tears down the HTTP request coroutine's pooled connections. Connections borrowed by child coroutines (Coroutine::create in app code) and coroutine-based daemons bypassed release() entirely, with two consequences:

1. Permanent counter drift → false pool exhaustion. Each such borrow leaks one pool slot forever. Reproduced end-to-end on main with a real Octane server against MySQL: after just 10 child-coroutine borrows, the pool pins at 10/0 and 0/20 subsequent HTTP requests succeed — the worker is down while looking healthy. Observed in prod as the one uncensored-chat connection that outlived every recycling cycle and grew its leaked-statement count unbounded.
2. Unbounded statement leaks on long-lived borrows. max_lifetime recycling only runs at release, so a connection that never releases accumulates leaked server-side prepared statements indefinitely (the error-1461 incident class).

Fix — defense in depth

• DatabaseManager arms a Coroutine::defer at borrow time (once per coroutine): at coroutine exit it collects the coroutine's cycle garbage at the safe point (same ordering as the Worker) and releases whatever the context still holds. A no-op for request coroutines — the Worker empties the context first.
• DatabasePool tracks every connection it created via WeakReference and heals the counter for any that were garbage-collected without release — including the object-id-reuse race where an abandoned connection dies inside factory->make() and the new connection inherits its id.
• poolStats() now reports tracked_connections and long_borrowed_connections (borrows held past max_lifetime — a live pointer at daemons that never release).

Verification

• End-to-end (real octane:start, real MySQL, this branch): 50 child-coroutine borrows → pool at 1 connection fully returned, 20/20 requests OK, 0 leaked statements (main: exhausted at 10, service down).
• Mixed load (wrk + 200 spawns, 30s): 732 req/s, zero non-2xx, all 10 pool slots returned — no throughput regression.
• PR Fix server-side prepared statement leak from pooled connections #13 leak-ordering regression storm: 92 leaked vs 566 on old code — unchanged band.
• 167 package tests green; every new guard is mutation-tested (fix removed → its test goes red): exit-hook release, gc-before-release ordering, heal-on-overwrite for reused object ids, no-op-prune skip, vanished-slot reconciliation.
• Swoole semantics verified empirically on this build: defers run before context destruction; Channel holds real zval references (a channel-held connection can never be misread as vanished).
• Adversarial review round completed; all findings fixed and covered by the mutation-tested cases above.

Known residual

A daemon coroutine that literally never ends still holds its connection (nothing can force-release a borrow in use); long_borrowed_connections now makes those visible, and such loops should call releaseConnections() per iteration — documented in the code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}