feat(multidb): add MultiDBClient orchestration layer - #3950

- PubSub conns are untracked from their owning member's pool on close
  (per-conn owner map), the registry deregisters closed subscriptions via
  onClose, and pubsub options are always initialized (cloned, not shared)
- retried commands clear the previous attempt's error before re-execution
- SetActiveIndex/ForceActiveIndex read the active index under failoverMu,
  honor the switch result and reset the failure detector on a real change
- RemoveDatabase serializes with failoverMu so the active-index shift
  cannot race a concurrent failover
- cluster member databases also get maintnotifications disabled by default

- Close snapshots the pubsub registry and closes subscriptions outside
  pubsubMu (PubSub.Close re-enters the registry via onClose)
- initial active selection keys off the startup probe results, not just
  circuit state, so a probe-failed high-weight member is never selected
- SetActiveIndex holds failoverMu across lookup, probe and switch so a
  concurrent RemoveDatabase cannot shift the target
- client-side errors (context cancellation, deterministic local
  rejections per shouldRetry) no longer record breaker/detector failures
  or trigger failover; they return to the caller directly
- failuredetector: replace the claim-then-zero bucket reset with an
  atomically swapped immutable-epoch bucket state, fixing the lost-count
  race behind the flaky concurrent-record test

- retryable server replies (LOADING, READONLY, CLUSTERDOWN, ...) now
  classify as availability failures instead of healthy replies, so the
  breaker/detector see them and failover can trigger
- locally synthesized Redis errors (ErrCrossSlot) are neutral: they no
  longer count as proof of a healthy server
- single-command retries honor Cmder.NoRetry: streaming commands record
  the failure but are never replayed
- candidate snapshots, background checks and failover re-checks use a
  non-reserving circuit-state read so they cannot exhaust a recovering
  member's bounded half-open probe budget
- auto-fallback selection runs under failoverMu, closing the same
  removal race fixed for manual failover
- a successful SetActiveIndex probe resets the target's breaker so the
  switch sticks when the member recovered before the grace period

- initialization reconciles breakers with the final probe pass: probe-
  healthy members get a fresh breaker (a blocking init that opened it is
  forgiven), probe-failed members get theirs opened so failover cannot
  select a database already known to be down
- process rejects commands with ErrClosed after Close instead of walking
  the failover escalation
- neutral outcomes release the half-open probe slot reserved by IsAllowed
- ForceActiveIndex resets the target breaker (unconditional override
  semantics); SetActiveIndex keeps the probe-then-reset behavior
- SetAutoFallback(true) works when the client was constructed with a
  negative AutoFallbackInterval (interval normalized on the core)
- the default failure detector is allocated per client instead of being
  written back into the caller's MultiDBOptions

- activeSnapshot loads the index under dbMu so it stays coherent with a
  concurrent RemoveDatabase slice shift
- switchActive returns an announce closure that callers invoke after
  releasing failoverMu, so OnFailover/OnActiveDatabaseChanged callbacks
  can safely call control APIs without self-deadlocking
- the retry loop re-enters the breaker gate after a failover (half-open
  slot accounting) without consuming a retry attempt
- blocking commands with their own read timeout are not retried on local
  read deadlines, matching *Client semantics
- manual selection resets the failure detector also for same-index
  overrides
- AddDatabase opens the breaker of a member that fails its initial probe
- the default cluster PING check reports an empty topology as unhealthy
- HealthCheckTimeout documents the ContextTimeoutEnabled interaction

Clone the caller's options (init normalizes in place and a second
client built from the same value would re-enable retries on the first),
reject and re-check Close in AddDatabase so a raced member cannot leak,
assign the new member's index before its initial probe, deliver
OnCircuitStateChanged asynchronously (FIFO per database) so callbacks
may call control APIs without self-deadlocking, stay on a recovered
active instead of escalating when no alternate candidate exists, return
ErrClosed from post-close PubSub dials so the channel loop terminates,
and treat caller-canceled probes as neutral for the breaker.

Check the failure detector before the breaker admission gate so a
detector-routed failover cannot leak a half-open probe slot, surface
the caller's context error from a canceled pre-failover probe instead
of charging a failover attempt, break the consecutive-failed-attempts
escalation chain on any successful command, reset the detector after
an auto-fallback switch, return terminal ErrClosed for PubSub dials on
cluster-only configurations, and stop recording probe outcomes for
members removed while a background snapshot was in flight.

Reconnect PubSubs asynchronously after an active-database change so
the command that triggered the failover is not billed for dial and
resubscribe work, reject RouteByLatency/RouteRandomly on sentinel
members during validation (NewFailoverClient panics on them), leave
breakers untouched for startup probes that died with the caller's
context, wrap default-policy health checks with panic recovery, and
document why PubSub options are captured at Subscribe time.

Record background health-check successes through the breaker's
external path so they cannot release half-open slots held by real
command probes, delegate DBSize/ScriptLoad/ScriptFlush/ScriptExists to
the active member so cluster members keep their fan-out semantics, and
reject the HIMPORT command family (fieldset registrations are per
member client and would silently be lost on failover; fan-out is
tracked as follow-up in the design doc).

Classify local pool saturation (ErrPoolTimeout/ErrPoolExhausted) as
neutral so client capacity pressure cannot open a healthy member's
breaker or trigger failover, and bound consecutive admission-gate
rejections: when every selectable member is half-open with a full
probe budget, the command now surfaces ErrTemporarilyNotAvailable
instead of ping-ponging the active index in a busy loop.

Check the caller's context after successful control-path probes so a
SetActiveIndex/AddDatabase whose context died mid-probe cannot still
switch the active database or mutate membership, and give sentinel
members a private FailoverOptions copy like standalone and cluster
members get.

Callbacks run on a library-owned goroutine: recover a panicking user
callback (logged via internal.Logger) so it can neither crash the
process nor leave the queue wedged in the draining state.

Use the live active index (not the caller's possibly-stale snapshot)
for the no-candidate recovery verdict, reset detector and escalation
state only when the active switch actually happened (a lost CAS means
a concurrent failover already handled it), re-check the caller's
context after a successful pre-failover probe and after waiting for
the failover lock, and document that a custom FailureDetector must not
be shared across clients.

Filter circuit-state callbacks for removed members at dispatch time
(a stale probe snapshot can record an outcome after the removal), and
re-check the caller's context after acquiring the failover lock in
AddDatabase (whose SkipInitialHealthCheck path had no later check) and
RemoveDatabase (which never checked it), so operator requests that
died while queued cannot still mutate membership.

SetActiveIndex/ForceActiveIndex report ErrClosed after Close instead
of an out-of-range error from the drained membership, and an explicit
healthy selection clears the failed-failover escalation chain also
when the selected member is already active.

Fail construction when the caller's context dies during the startup
probes (a late-healthy probe must not birth a live client the caller
gave up on — supersedes the earlier neutral-probe reconciliation, now
unreachable), re-read the removed flag and index at callback DELIVERY
time so a removal landing while a callback is queued cannot surface a
reindexed member, clear the failed-failover chain on successful
auto-fallback, re-check the context after tryFailover's lock wait, and
deep-copy the nested CircuitBreakerConfig into the private options so
runtime-added members cannot diverge from the initial ones.

Recover panicking OnFailover/OnActiveDatabaseChanged callbacks (the
announce closure also runs on the background loop), reject hand-built
HIMPORT commands at Process, add the ErrClosed guard to RemoveDatabase
and the cluster fan-out overrides, mark aborted AddDatabase members
removed so queued callbacks cannot surface a never-added index, and
give the private options copies of HealthChecks and cluster seed
addresses. Also pins that mid-read connection resets are recorded on
the breaker (shouldRetry matches every net.OpError via Timeout()) —
refuting a review claim to the contrary.

Re-check closed after acquiring the failover lock in tryFailover,
setActiveIndex and RemoveDatabase (an op queued behind the lock when
Close lands must report ErrClosed, not act on drained state), notice
Close inside the command retry loop instead of escalating through an
empty membership, make canceled probes neutral for BOTH verdicts (a
late healthy result could close an open circuit for an operation that
returns context.Canceled), and run user failover strategies with panic
recovery — they execute on the library-owned background loop too.

A raw Do(ctx, "himport", ...) builds a plain *Cmd that the typed
marker interface misses; match the command name as well. Also classify
the local HIMPORT rejection as neutral defensively — it is a RedisError
only so batch machinery treats it per-command, and must never count as
proof of a healthy server.

isRedisReplyError matched only the concrete proto.RedisError string;
typed replies parsed by the reader (NOAUTH, NOPERM, EXECABORT, MOVED,
...) fell through to outcomeNeutral instead of outcomeSuccess. Match
the root Error marker interface so typed and string replies classify
identically (availability replies already reached outcomeFailure via
shouldRetry's typed checks).

The single-command gate admitted closed-state commands via IsAllowed,
then settled successes with RecordSuccess and neutrals with an
unconditional ReleaseHalfOpen — a command outliving a later open ->
half-open transition freed a probe slot it never reserved. The gate now
uses Allow: unreserved successes count via RecordExternalSuccess and
unreserved neutrals release nothing.

DBSize/ScriptLoad/ScriptFlush/ScriptExists delegate to the member
client directly when the member is a cluster (fan-out semantics), so
MultiDB-level hooks do not wrap them — same contract as Watch; use
AddDatabaseHook to instrument that traffic.