Fix cross-thread data races where event-loop coroutines complete off the loop thread

[battlesnake]

rpp::event_loop is meant to resume every coroutine on its own thread. Two related cases broke
that and tripped TSAN — both with the same root cause: completion was observed off the loop
instead of routed back to it.

The two races

1. event_task awaiting a task — if the task's body finished on a pool thread (because it
   co_awaited an rpp::cfuture), task_final_awaiter did a symmetric transfer that dragged the
   event_task onto the pool thread, racing the loop's done() check.
2. run_until_done(task<T>&) / (deferred<T>&) — these drove a top-level task by polling
   handle.done() in a loop. If the task finished on a pool thread, that poll raced the pool
   thread on the frame, and the result could be read with no happens-before.

Repro for (1), now a regression test:

auto pool_completing_task = [&]() -> rpp::task<int> {
    rpp::cfuture<int> fut = rpp::async_task([] { rpp::sleep_ms(1); return 42; });
    int r = co_await fut;   // cfuture resumes the task body on a POOL thread
    co_return r;            // co_return -> task_final_awaiter runs on the pool thread
};
rpp::event_task et = [&]() -> rpp::event_task {
    int r = co_await pool_completing_task();  // before fix: continuation drifts off-loop
}();
loop->run_until_done(et);

The fix — make completion loop-affine

• task_final_awaiter posts the awaiter's continuation back to the owning loop (via a
  thread-local loop handle) instead of resuming inline on whatever thread finished the task. A
  small lock-free CAS handshake on promise.continuation coordinates the two sides — the loop
  thread registering the awaiter vs. the pool thread completing — with no lost wakeups or
  double-resumes. Standalone use (no loop) is unchanged. The captured loop handle is a plain
  member published through that CAS, so it stays correct on weak-memory hardware (ARM).
• run_until_done(task/deferred) now awaits the task from a tiny internal event_task and
  reuses the (now loop-affine) event_task driver, so the result is produced and the frame
  destroyed on the loop thread. The old polling loop is deleted.

No public API change — the new pieces live in rpp::detail.

Verification (gcc + clang, TSAN)

• test_event_loop 49/49, including 5 new regression tests (event_task await, plus
  run_until_done for task / deferred / void / exception propagation). The key ones stay clean
  30–50× under test_until_failure.
• Full suite green except the pre-existing basic_duration_coro timing assertion (fails on
  master too — TSAN overhead).
• clang-tidy clean. The 2 pre-existing test_event_loop warnings (lines 89/149) are a
  different mechanism (background_awaiter_fut) and are left untouched.

Notes

• README.md line references refreshed mechanically (update_doc_linerefs.py); no API or
  display-text changes.
• 6 commits, kept separate to show the progression (race fix → memory-ordering fix → simplify →
  demote-to-plain → docs → the second race). Squash-merge if you'd rather have one.