Run the plane over a real QUIC session

Publish and discover are two origins, not one. On a local origin they are
the same object and it makes no difference; over a session they are
publisher() and consumer(), and conflating them is how a client publishes
into the void or watches an origin nobody announces on. The plane takes them
separately now and defaults the local case to a one-liner.

The test stands a relay up in-process -- MoqServer, a self-signed
certificate, one origin wired as both what it publishes and what it
consumes, which is what makes it a relay rather than two unrelated halves --
and dials it over actual QUIC. A frame goes out, is announced back through
the relay, discovered, subscribed and decoded. Thirteen pumps.

Everything is polled, the relay's accept included: the client cannot finish
connecting until the relay accepts, and there is no other thread to do it
on. That is a fair model of the real thing, where glimmer's timer is the
only clock this code gets.

Two things the Python control taught before any of it was written.

listen() is ASYNC. It reads like a synchronous bind, and not awaiting it
leaves the server not listening -- reported later, and confusingly, as
`bind: not listening; call listen() first`.

And a session must be TOLD, not merely dropped. Freeing the handle without
shutdown() or cancel() panics the process: the drop tries to close the QUIC
connection from whatever thread got there, and outside a tokio worker there
is no reactor to do it on. Either call prevents it, and the plane now makes
one in a finally. That is a crash we would otherwise have found on the first
hung-up call rather than here.

frq.av is still untouched. What is left before it can switch: V4L2 and ALSA
wired in as the plane's actual source and sink rather than test thunks, the
status transitions frq.av reads out of poll_status, and Android.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>