Unhealable-gap strike defense (reintroduced for review)

[jpcamara]

Adds an unhealable-gap strike defense to the sync channel (now in yrby-rails).

Release context: these fixes shipped briefly as 0.3.0, were reverted from main (261e648), and were superseded on RubyGems by 0.3.1, which carried the identical fixes with the strike defense removed. This PR reintroduces the strike defense for review; its changelog entry sits in the Unreleased section.

After gap_strike_limit rejections (default 3, minimum 2) of the same update on one connection, the channel stops resyncing it forever and settles it with { "ack" => id, "dropped" => true }. This breaks the poisoned-client retransmit loop (id-less frames several times a second) while never dropping a healable gap, since those heal within a resync or two and healing frees the strike.

Design points:

• sync_gap_strike / eviction (lib/y/action_cable/sync.rb): a SHA-256-keyed per-connection table bounded at 64 keys. At capacity it evicts one lowest-count entry, only on new-key insert, so distinct-gap flooding can't reset a tracked key. Mutex-guarded, since ActionCable dispatches one connection's messages to a worker pool.
• AnyCable state: strikes persist across the per-RPC fresh channel instance via anycable-rails' state_attr_accessor (istate, round-tripped through anycable-go), declared automatically at include time, with a plain-ivar fallback when anycable-rails is absent.
• The dropped ack flag and client handling (yrby-client): the client prunes the queue either way (retransmitting an unhealable update loops forever) but surfaces the drop via onError(..., "ack-dropped") instead of reporting synced over lost data. Older clients ignore the key.
• gap_strike_limit floor of 2 (ArgumentError below): strike 1 must send a resync before any drop is justified. nil disables the feature entirely (resync-forever, the prior behavior).

Verification: 107 Ruby tests including an AnyCable simulation (fresh instance per message plus JSON istate round-trip), strike-out, eviction-can't-reset (72-update GapFlood fixture), heal-frees-slot, dropped-flag-only-on-settle, and limit validation; 54 client tests including dropped-ack surfacing; and e2e on both stacks (frontend/gap_strike.mjs, wired into CI): poisoned client → resync ×2 → {ack, dropped: true}, never recorded, healable gap still records; 9/9 on Puma ActionCable, 9/9 on AnyCable.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[jpcamara]

Moot after #56: causally gapped updates are recorded and acked like any other, so there is no reject path left to storm and nothing for a strike defense to defend.