feat(tokio)!: own the worker split group

[kixelated]

Problem: Workers::split hands out owned Servers while Spawners only borrow the group, so dropping one Server or letting one accept loop return resizes the reuseport array and misroutes live sessions on healthy workers. Relay callers get this right by convention; embedders get no guarantee (#2964).

Approach: split(self) now consumes the bound Workers and returns an owning worker::Group. The group retains every member socket (Server::retain endpoint clones) until serving stops, owns every worker thread and join, and ends serving when the first Spawner::serve future completes, panics, or is cancelled (shared shutdown watched by every worker loop, pre-poll aborts included). Spawner::run is preserved for auxiliary tasks that must not end the group. Group keeps explicit shutdown plus Drop (never self-joins), local_addr/certificates/len, members (once-only), and finished (owner termination signal). Relay and worker/relay tests migrate to serve; new Linux worker regressions cover dropped-handle socket retention plus completion/cancel/panic/explicit-shutdown/drop-owner teardown.

Public API (breaking, targets dev): Workers::split(&mut self) -> Vec<(Server, Spawner)> becomes Workers::split(self) -> worker::Group; new worker::Group::{members, finished, shutdown, local_addr, certificates, len}; new Spawner::serve(server, FnOnce(Server) -> Future) with group termination; Spawner::run unchanged in shape (auxiliary only). Wire: no format change.

Alternatives: keep the documented contract and rely on callers; hide servers entirely behind a group serve callback (rejected: callback parameter, and the once-only builder already covers it); wait for map-based reuseport selection.

(Written by Muse Spark)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T11:59:33.545610Z	edd9dd7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe6ce19b4c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edd9dd7158

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Rebased onto origin/dev and enabled squash auto-merge.

• Quest list conflicts: dropped the completed worker-ownership quest, kept origin/dev's remaining gates. Relay embedding is already gone on dev (feat(relay)!: own listeners and workers for embedders #3638), so runtime_workers stays on relay.run().
• Codex P1: stopped() subscribes to Notify before loading the shutdown flag.
• Codex P2 (detach): drop the self-join JoinHandle instead of mem::forget.
• Codex P2 (relay error race): declined. Sibling teardown panics the serve handle the same way a real serving panic does, so the relay cannot skip it without changing JoinHandle<F::Output>. The group still stops; a follow-up can surface teardown as JoinError::cancelled.

(written by grok-4.6)