Fix M1: stale pooled handle can corrupt the pool under double-close/use-after-close

A pooled Query/Sender handle was the reused per-slot object itself, guarded
only by a non-volatile in-use/borrowed flag. Once a worker/slot was released
and re-borrowed, that flag flips back to "live", so a stale handle's
close()/cancel()/write would leak into a *different* borrow: a duplicate close
double-released the worker/slot (enqueued twice -> two concurrent borrowers on
one non-thread-safe client/delegate), and a cached Completion.cancel() or stale
write hit whatever borrow now owns it. Idempotent close() and no-op cancel()
are documented contracts, so this was reachable from contract-legal code, not
just misuse, with pool-wide blast radius and no -ea guard.

Fix: give every borrow its own immutable generation, stamped under the pool
lock when the worker/slot is handed out and bumped again when it is returned.
The reused state stays on the slot; callers get a thin per-borrow handle that
carries the generation and validates it on every operation:
  - close()/cancel() are no-ops on a stale generation (idempotency preserved),
  - submit()/data writes throw,
  - release/giveBack/discardBroken re-check the generation under the pool lock
    so a worker/slot can never be enqueued twice, plus an -ea assert that it is
    not already in the available deque.

Egress: QueryImpl stops being the user-facing Query; new QueryLease wraps it.
Ingest: new SenderSlot is the reused slot; PooledSender becomes the per-borrow
wrapper (keeps the public name, so borrow() still returns it). The per-submit
path stays allocation-free; only the small lease handle is created per borrow
(routinely scalar-replaced under try-with-resources).

Adds QueryLeaseGenerationTest and SenderLeaseGenerationTest covering the
double-release and cross-borrow cancel/write paths; updates the white-box
tests to the new shapes. Full core suite green under -ea (the lone failure is
the unrelated pre-existing FilesTest M2, which fails identically on master).

Author: bluestreak01

core/src/main/java/io/questdb/client/Query.java

@@ -36,9 +36,11 @@
  * {@link #close()} it to release the client back to the pool (typically via
  * try-with-resources).
  * <p>
- * Allocation: zero at steady state -- {@code borrowQuery()} returns a
- * pre-allocated handle bound to the leased pool slot, and the
- * {@link Completion} is a field on it reused across submits.
+ * Allocation: the per-submit path is allocation-free -- the heavy query state
+ * is pre-allocated on the leased pool slot and reused, and {@link #submit()}
+ * returns this same handle as its {@link Completion}. {@code borrowQuery()}
+ * creates one small lease handle per borrow (often scalar-replaced by the JIT
+ * when used with try-with-resources).
  * <p>
  * Lifecycle: configure with {@link #sql}, optional {@link #binds}, and
  * {@link #handler}, then call {@link #submit()} to obtain a {@link Completion}
@@ -83,10 +85,10 @@ public interface Query extends Closeable {
     Query sql(CharSequence sql);
 
     /**
-     * Submits the query for execution on the leased client. Returns the
-     * {@link Completion} field cached on this handle; never allocates. The
-     * handle is single-flight: {@code await()} the returned Completion before
-     * the next {@code submit()}.
+     * Submits the query for execution on the leased client. Returns this handle
+     * as its own {@link Completion}; never allocates. The handle is
+     * single-flight: {@code await()} the returned Completion before the next
+     * {@code submit()}.
      *
      * @return the single-flight Completion bound to this Query handle
      */