fix(rust): isolate GitHub token callbacks from request routing

[xianjianlf2]

Fixes #2424.

A pending GitHub token callback currently holds up the single Rust request-routing loop; a callback panic terminates that loop without replying. Give each token-provider registration a lazy FIFO worker so other providers and session requests can continue while preserving callback order within a registration. Catch callback panics and return an internal RPC error without including the panic payload.

The registration owns and aborts its worker on retirement. Workers retain a weak client reference, so pending callbacks do not keep the client alive. No public API or protocol changes.

Three regression tests exercise blocked-provider isolation (including same-provider FIFO and an unrelated user-input request), panic recovery, and cancellation on session deletion, force-stop, and dropping session/client handles. The blocking and panic tests fail on the base commit.

Validation:

• 234 Rust unit tests and 135 session integration tests passed using in-memory JSON-RPC streams.
• Pinned nightly rustfmt check passed.
• Clippy across all targets with test-support,bundled-in-process and the repository's strict warning flags passed.
• git diff --check passed.

Validation used COPILOT_SKIP_CLI_DOWNLOAD=1; live CLI/provider E2E tests were not run. No new dependencies. Codex assisted with implementation and validation.