relay: keep registry forwarders behind a ForwarderRef

[afrind]

In local-forwarder mode a SubscriptionRegistry entry held a shared_ptr to a forwarder that lives on the publisher's executor, so the relay executor could read its counters, run its destructor, or hand it to a subscriber thread that later found it displaced. Entries and every view over them now hold a ForwarderRef: a caller that owns the forwarder pins it inline, and everyone else posts to its executor. Entry cleanup keys off the entry's ForwarderId instead of locking a weak_ptr, which used to decline to erase an entry exactly when its forwarder was already gone, leaving an unfulfilled promise that every later subscriber to that track waited on forever. The local-forwarder fan-out now carries a track name and executor and resolves the publisher forwarder on that executor at the point of use, so a subscriber whose hop lands late fails with "publisher forwarder gone" rather than attaching to a forwarder nobody feeds.

---

This change is 

[gmarzot]

@gmarzot reviewed 6 files and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on afrind).

[gmarzot]