fix(json): end a stream track when a record cannot be written

[kixelated]

Stacked on #3109 (base is claude/json-tracks-catalog-api-a13c8c, not main). rs/moq-binary/ and rs/moq-mux/src/json.rs only exist there. Merge after #3109.

Summary

• Root cause. moq_json::stream::Producer::append recovered from a failed frame write by closing the group and letting the next append open a fresh one. A stream track is a single group, so the roll produces a log with a hole in it. Worse, a subscriber joining after the roll starts at the latest group (Subscription::group_start defaults to None) and never sees the records before it, and latency_max defaults to Duration::ZERO so the publisher skips the older group as soon as a newer one exists. A visible failure beats a silently gapped log.
• Contradicted the spec in two places: the Timeline Track section of drafts/draft-lcurley-moq-hang.md says the timeline track is "a single compressed group that is never rolled", and the Data Tracks section (added in feat(hang): add json and binary data tracks to the catalog #3109) says a publisher that cannot write a payload MUST close the track. feat(hang): add json and binary data tracks to the catalog #3109 fixed this for moq-binary and worked around it at the moq_mux::json::Stream wrapper, but deliberately left moq-json alone.
• Any append failure now ends the track. A write into the live group aborts it, and so does a record that never encodes: nothing was published either way, but the log is missing a record all the same. Opening the group is the one remaining non-aborting path, and only because append_group fails when the track has already ended.
• Both failure paths reset the DEFLATE encoder. Without that, the uncommitted Pending's desync latch answers the next append ahead of the track and masks the real reason the log stopped. With it, an append onto an aborted track falls into the open branch, where modify() returns the stored abort error verbatim.
• Aborting goes through a cloned track handle in both crates. track::Producer::abort consumes self, which tempts an Option<Producer> and an Option<Subscriber> from consume; track::Producer is Clone, so the abort reaches the shared state while the producer keeps its handle. Producer::subscribe already documents that info survives a close/abort and the subscriber surfaces it on first read, which is what tells a late reader the log is truncated. This also removes the Option<Subscriber> that feat(hang): add json and binary data tracks to the catalog #3109 introduced in moq_binary::stream, so both crates now match every other producer in the workspace.
• Inner::finish finalizes the group and the track independently in both crates, so an error finalizing the group can't leave the track open (the bug fixed for moq-binary in 1664399).
• moq_mux::json::Stream::append drops its workaround and simply retires the catalog entry, which is now correct for every error rather than only the ones that reached the wire.

Callers cope: container::Producer::write already drops the Recorder on the first record() error and carries on, so terminal-vs-recoverable changes nothing for the timeline. timeline::Producer::finish() after an abort returns the abort error rather than panicking, since its unreachable! arm only covers non-Net errors.

One imprecision worth flagging: an encode failure aborts with moq_net::Error::Cancel, whose doc says "Not a failure". Delivered through abort the consumer still gets an Err rather than a clean end, so the behavior is right, but no variant means "the publisher could not encode this record". Adding one means touching moq_net::Error, a #[non_exhaustive] public enum in a core crate, which felt out of scope here.

Public API changes

No new, renamed, removed, or signature-changed pub items. Two behavior changes to published surfaces:

• moq_json::stream::Producer::append (moq-json 0.3.6): a failure is now terminal for the track instead of rolling a group. Not a semver break under CONTRIBUTING's rule, which reserves dev for a renamed/removed/signature-changed item in the listed crates.
• moq_binary::stream::Producer::consume and moq_mux::{json,binary}::Stream::consume revert from Option<moq_net::track::Subscriber> to moq_net::track::Subscriber. Both are unreleased, introduced by feat(hang): add json and binary data tracks to the catalog #3109.

Cross-package sync

• No draft change. drafts/draft-lcurley-moq-hang.md already specifies exactly this behavior in both the Data Tracks and Timeline Track sections; the code was the thing out of step. just drafts check passes.
• No wire format change, so no js/ mirror is needed: this is publisher-side failure handling, and the bytes a conforming publisher emits are unchanged.

Test plan

• just check and just test (1728 passed, up from 1727), just drafts check, all green.
• New/updated in rs/moq-json/src/stream/mod.rs: a_failed_write_aborts_the_track (a subscriber must see an error, not the clean end a completed log looks like), a_failed_write_ends_the_track (the retry reports the abort rather than Error::Desync, and a subscriber taken after the abort still surfaces it), appending_after_finish_fails_without_aborting (a clean finish must stay readable), and a_rejected_record_does_not_open_a_group extended to assert the track ends.
• New in rs/moq-mux/src/json.rs: an_unserializable_record_ends_the_track_and_the_entry, which fails without the encode-path fix because the second append used to succeed on a track whose catalog entry had already been retired.

(Written by Claude Opus 5)