fix(agent): retire replaced tunnel sessions

[Sagit-chu]

What changed

• fix Transport.Copy so multiplex routes receive an independent transport wrapper
• retire replaced runtime chains instead of abandoning cached tunnel sessions
• gracefully drain KCP, MTCP, MTLS, MWS, and MWSS sessions before closing them
• close pre-handshake sockets and prevent retired dialers from accepting new connections
• preserve shared hop ownership while releasing chain-owned resources

Root cause

Runtime chain replacement overwrote the registry entry without retiring resources owned by the previous chain. Multiplexed dialers could therefore retain background sessions, sockets, and buffers after repeated tunnel updates. Transport.Copy also returned the original transport rather than the copy, causing route state to be shared.

Impact

New connections switch to the replacement chain immediately. Existing multiplexed streams are allowed to drain, and the retired backing session closes after it becomes idle, avoiding both resource accumulation and unnecessary connection interruption.

Validation

• cd go-gost/x && go test ./... — 67 tests passed across 205 packages
• cd go-gost/x && go test -race ./chain ./registry ./internal/util/sessionretire ./dialer/kcp ./dialer/mtcp ./dialer/mtls ./dialer/mws — 13 tests passed across 7 packages
• cd go-gost && go build -o /tmp/flux_agent_buildcheck . — successful