Validate client buffer registration ownership

[cursor]

Bug and impact

A client could send raw RegisterClientBuffer/UnregisterClientBuffer requests for another publisher's channel/session/buffer group. The server accepted those requests without tying them to the publisher that owns the buffer group, allowing fd-backed/split-buffer registrations to be overwritten or erased. On Android fd-backed buffers this could make subscribers map the wrong or missing backing fd, causing crashes or corrupted reads.

Root cause

Client-buffer registration metadata was keyed only by session and buffer index, and the register/unregister protocol carried no publisher ownership token. Server handlers validated the session/channel but not that the requesting connection owned the publisher or the existing buffer group.

Fix

• Add publisher_id to client-buffer register/unregister protocol messages and shadow events.
• Have C++ and Rust clients send the server-assigned publisher id.
• Validate register/unregister requests against the current ClientHandler's owned publisher, including virtual-channel mux registrations.
• Store publisher_id with registered buffer groups and reject cross-owner overwrites/removals.
• Reject malformed fd-backed registrations with missing/invalid fd indexes.
• Add raw protocol regression tests for foreign overwrite and unregister attempts.

Validation

• $HOME/go/bin/bazelisk test //server:server_test
• $HOME/go/bin/bazelisk test //client:client_test //shadow:shadow_test
• $HOME/go/bin/bazelisk test //rust_client:client_test //rust_client:syscall_failure_test
• $HOME/go/bin/bazelisk test //...