feat(transport): introduce stream I/O timeouts - #1518

When a transport drains ingress after all `Incoming` handles are
dropped, a peer that never closes its end previously kept the ingress
task and the connection alive forever. If a read timeout is set, fail
ingress with `ErrorKind::TimedOut` once the peer does not close the
stream within the timeout after all handles are dropped, releasing the
connection.

Assisted-by: claude:claude-opus-5-5

Add `invoke::IoTimeout` and `invoke::IoTimeoutOwned` wrappers, which
bound the `Invoke::invoke` call, including the synchronous parameter
write, and apply a read and write timeout to the `Incoming` and
`Outgoing` streams it returns, so that an invocation errors instead of
hanging when the server stops reading or responding mid-invocation.

This is kept separate from `InvokeExt::timeout`, which still only
bounds the `Invoke::invoke` call, since an I/O timeout also bounds the
handler's time to first result byte and applies to async sub-streams,
which may legitimately outlive the invocation and idle for longer.

Assisted-by: claude:claude-fable-5-1
Assisted-by: claude:claude-opus-5-5

Add `serve::IoTimeout` and `serve::IoTimeoutOwned` wrappers, mirroring
the `invoke` ones, which apply a read and write timeout to the
`Incoming` and `Outgoing` streams of every accepted invocation. A client
that sends fewer parameter bytes than the served function expects and
then keeps the connection open previously left the server-side decoder
pending forever (#1045); with a timeout the
invocation now fails with `ErrorKind::TimedOut` and its resources are
released. Likewise, a client that stops reading results no longer
blocks the connection forever.

The timeout does not bound reads a transport does before yielding an
invocation, such as the header read in `frame::Server::accept`.

Closes #1045

Assisted-by: claude:claude-fable-5-1
Assisted-by: claude:claude-opus-5-5