fix: reject replies from retired streamable http sessions

Keep the inbound transport generation with automatic handler responses
and errors. Reject replies after session recovery, including during the
shutdown drain, without adding wire metadata.

Match the completing handler's token before removing its request id so
an old handler cannot cancel a replacement that reuses the id.

Cover late replies, id reuse, scoped send context, and shutdown races.

Author: nickcoai