fix(homeassistant): bound every wedgeable await during connect and teardown

[Sora-bluesky]

This is the first half of the split I promised in #68540: the bounded-await hardening alone, without the watchdog machinery.

The problem (#67470): the HA adapter could go silently deaf. Several awaits in the connect/teardown path had no bound, so a wedged WebSocket close or a hung auth handshake left the adapter stuck forever while the gateway still reported "running".

What this PR does:

• _ws_connect() now builds the session into a local first and closes it on failure or cancellation (the session leak egilewski probed in fix(homeassistant): bound every wedgeable await and watchdog the listener #68540), and bounds all three auth handshake steps with _HANDSHAKE_TIMEOUT
• in teardown (disconnect() / _full_teardown() / _cleanup_ws()), every close and cancel is bounded by _DRAIN_TIMEOUT, and a close survives a second cancellation racing in while it is still running (the close detaches and is tracked in _teardown_tasks)
• a module-level _run_bounded_close() primitive plus a _cancel_task_bounded() adapter method, which the follow-up PR reuses

This PR does not add the watchdog or stall detection. That is the second half (watchdog plus stale-generation guard). It builds on these primitives and comes as a separate PR once this one lands.

Verification:

• 15 tests, all carried over from the fix(homeassistant): bound every wedgeable await and watchdog the listener #68540 suite (13 bounded-await, 2 primitive tests)
• mutation check: removing the cancel-safe close in _ws_connect makes 3 tests fail, restoring it goes green
• every line traces back to the reviewed fix(homeassistant): bound every wedgeable await and watchdog the listener #68540 head (f862558) or current main. I wrote no new implementation for this split
• rebased on current main, so it includes the HASS_TOKEN scoped-secret read

#68540 stays open for reference. Happy to close it once both halves are in, or however you prefer to handle it.