fix(ws): give runWriter exclusive ownership of provider conn writes

[Augustas11]

Summary

Closes the concurrent-writer hazard on provider WS conns that PR #104's deadline-refresh fix surfaced but didn't fully resolve. runWriter is now the sole goroutine writing WS frames to a provider conn after handshake; reactive PONG/Close replies and server-initiated Close frames funnel through writeCh as pre-baked raw frames instead of racing it on the wire.

• Hazard. wsutil.WriteServerText / gobwas.WriteFrame each issue two underlying conn.Write calls (header, then payload). Before this PR, runWriter and the read goroutine (via gobwas's ControlHandler.HandlePing/HandleClose) both wrote directly to the same conn. A PONG arriving between runWriter's header and payload writes interleaves at the WS framing boundary — invisible to -race (because net.TCPConn.Write is internally locked) and surfaces as parser failures on the receiving side. Additional racing paths: admin-reject Close (admin_endpoints.go), and the two json.Marshal failure paths in handleV1Conn/handleV2Conn after registerProviderSession.
• Fix (Option 2 — single-writer ownership). writeCh now carries providerFrame{raw, payload}; runWriter dispatches text → wsutil.WriteServerText, raw → one conn.Write of pre-baked bytes. readClientData takes a controlReply func([]byte) error; the post-handshake path passes session.enqueueRaw, pre-handshake passes directControlReply(conn) (replaces deadlineRefreshingWriter and preserves its deadline-refresh semantics — TestProviderControlPongSurvivesStaleWriteDeadline still passes). The control handler captures gobwas's PONG/Close-echo bytes into a bytes.Buffer (with DisableSrcCiphering: true, matching the contract wsutil.ControlFrameHandler relies on with wsutil.Reader) and hands the assembled frame to controlReply. New s.closeSession(session, code, reason) enqueues a Close frame + schedules conn.Close after a 100ms drain; replaces the three post-runWriter direct-Close sites (admin reject; v1/v2 ack-marshal failure).
• Regression test (relay_writer_serialize_test.go). 200 concurrent text sends + 200 inbound client PINGs over net.Pipe. Parses every wire frame with gobwas.ReadFrame; asserts no parse errors, expected counts, send-order preservation for text, exactly-once PONG echo per PING. Has teeth: a temporary regression shim that forced the old direct-write path failed the test 5/5 with unexpected opcode 8 (OpClose) parsed out of garbage bytes (the framing-corruption signature).

Test plan

• go test ./internal/ws/ -race -count=1 -timeout 300s → ok 11.0s (entire ws suite, including PR fix(ws): re-arm write deadline on reactive control replies #104's TestProviderControlPongSurvivesStaleWriteDeadline)
• New regression test under -race -count=30 → ok
• go vet ./... / go build ./... clean module-wide
• Teeth-check: regression shim forcing the old direct-write path → 5/5 failures with unexpected opcode 8 (framing corruption)
• Stage soak / live-fire — gated on operator heads-up per the live-fire convention