fix(semaphore): defer waiter waker drops

[tisonkun]

Summary

• restore permits reserved by a canceled waiter before dropping its Waker
• defer dropping a replaced Waker until after the waiters lock is released
• cover cancellation ordering with a regression test using the public semaphore API

The ordering matters because a custom RawWaker drop callback may panic or re-enter semaphore code. Keeping those callbacks outside the critical section also matches the deferred-drop convention used by the other internal synchronization primitives.

Testing

• cargo x lint
• cargo x test --no-capture