Track every waiting coroutine with Waiting

[otamachan]

Follows #63 and #64. Refactor only; no behavior change intended.

Each awaiter guarded the handle it hands out in its own way: Event and Mutex an active flag, send_request / send_goal a shared State with a done flag plus a destructor, TopicStream / GoalStream a destructor clearing waiter_, Sleep a done flag, and register_cancel an is_done predicate plus a weak_ptr to the stop callback. #63 and #64 added Waiting for the cases that had no guard.

Now every awaiter owns a Waiting, and whoever resumes it holds a weak_ptr to it:

• Waiting::take() hands the handle out once (atomic exchange). Whichever of completion and cancellation takes it first resumes the coroutine; this replaces the active / done flags and the is_done predicates.
• The weak_ptr expires with the awaiter, so a destroyed awaiter is never resumed; this replaces the destructors.
• Three helpers in executor.hpp:
  • resume_now(ctx, w): take and resume on the spot (Event::set, Mutex::unlock, stream messages, timer ticks, service responses).
  • post_resume(ctx, w[, claimed]): take now, resume on the executor if the awaiter is still alive (TF, goal response, Channel::send / close, and the synchronous stop callbacks of Sleep, TimerStream and Channel, which withdraw the waiter on the spot as before). Unlike Resume a posted waiter only while its awaiter is alive #63's version it takes at call time, as the replaced done flags were set at call time.
  • register_cancel(out, token, ctx, waiting, action): on a stop request, post; if the handle is still there, run action and resume.

Removed: the active flags and Waiter structs in Event / Mutex, the State structs of SendRequestAwaiter / SendGoalAwaiter (callbacks write into the awaiter only while its Waiting is alive), PendingRequest::active and ~LookupTransformAwaiter (a destroyed awaiter's request is dropped on the next check_pending), SleepAwaiter::done, and the destructors of Event, Mutex, SendRequest, SendGoal, TopicStream and TfBuffer awaiters. GoalStream::NextAwaiter keeps its destructor, which still cancels the goal.

Mutex::LockAwaiter::await_resume checked token.stop_requested() && !(active && *active). *active was always false by the time the awaiter resumed (both unlock and the cancellation cleared it), so this is token.stop_requested(), which is what it checks now.

colcon test passes (354 tests, ASan build, LeakSanitizer off), including the tests added in #63 and #64.