Bind async work to its JS runtime generation

[babzcraig]

Follow-up to #434. This is the per-generation liveness work you asked for, plus the smaller teardown races we found alongside it.

Your two commits from #434 are cherry-picked underneath, unchanged and still authored by you, so this branch applies to main on its own. If you would rather merge #434 first, do that and I will drop them and rebase.

The problem

React Native's bridgeless reload does not tear one runtime down and then build the next. RCTHost constructs the new RCTInstance while the old one is still invalidating, so two generations overlap. The process globals opsqlite::invoker and opsqlite::invalidated cannot describe that: whichever generation wrote last wins. A database created by the outgoing runtime would read the global invoker when its work completed, post into the runtime that replaced it, and call asFunction() on a jsi::Value owned by the dead one.

The commits

• Bind hooks and reactive flush to their runtime generation. Adds opsqlite::generation_alive, a shared_ptr<atomic<bool>> replaced by install() and cleared by invalidate(). DBHostObject captures the invoker and that flag at construction on the JS thread. They shadow the globals inside member functions, so every invokeAsync site in the class is fixed without editing each one.
• Bind promisify tasks to their runtime generation. Same fix on the thread pool: the invoker and flag are captured while the promise is constructed rather than read when the task finishes, and the early return tests this generation instead of the global.
• Interrupt in-flight queries before draining on invalidate. invalidate() waited on the pool but never called sqlite3_interrupt, unlike close() and delete(). React Native abandons module invalidation after ten seconds and destroys the runtime anyway, so an uninterrupted drain can lose that race.
• Guard the database registry with a mutex. open() runs on the JS thread and invalidate() on the TurboModule queue, and during a reload those overlap, so both can reach dbs at once. invalidate() now swaps the vector out under the lock and works on its own copy.
• Wake all thread pool waiters and make done atomic. waitFinished() and doWork() share one condition variable, so notify_one() can deliver the wakeup to the wrong waiter. done is read outside the mutex while the destructor writes it.
• Never let a pool thread join itself. A backstop for join() throwing "Resource deadlock avoided" if a future owner releases the pool on one of its own workers. Dropping the pool capture in Patches around async work #434 removes the known route there.

Deliberately left out

Our patch also bounds the drain (waitFinished(timeout)) and, on timeout, leaks the pool and the sqlite handle rather than freeing them underneath a live worker. That is a policy call about what to do when a query will not stop, and it did not belong inside a crash fix, so it is not here. Happy to open it separately if you want it.

Known limit

The early return in promisify still drops the last references on the pool thread, so ~jsi::Value runs there rather than on the JS thread. That behaviour is pre-existing, and the sqlite3_interrupt change makes it very hard to reach, but it is not airtight without either leaking the values or handing them to the JS thread.

Also worth noting: after this change, opsqlite::invalidated is written but never read, since promisify was its only reader.

[ospfranco]

Going to close this as I cleaned up a bit the code in #436 (and it's stack). I will still credit you :)

Moving some of the comments there