fix(sessions): make EventSubscriberLease dispose atomic; dedupe lease dispose

Issue 1: replace plain bool _disposed in EventSubscriberLease with an
Interlocked.Exchange int (_leaseDisposed) matching the SubscriberLease
pattern in SessionEventDistributor. Concurrent stream-completion +
client-cancellation racing Dispose() now decrements _activeEventSubscriberCount
exactly once, never to -1.

Issue 5: remove the `using` declaration on the subscriber lease in
EventStreamService.StreamEventsAsync; the finally block already disposes it
alongside the reader, so the using was a redundant second dispose on the
same code path.

Issue 2: add an inline comment at the StartAsync().GetAwaiter().GetResult()
call documenting the sync-over-async invariant (StartAsync only schedules via
Task.Run and is synchronous; do not make it truly async without changing
this call site).

Issue 10: remove the redundant .WithCancellation(cancellationToken) chained
on ReadEventsAsync(cancellationToken) in MapWorkerEventsAsync; the
[EnumeratorCancellation] token already flows through the direct argument.

Issue 9: add EventSubscriberLease_ConcurrentDispose_DecrementsCountExactlyOnce
to GatewaySessionTests — 16 concurrent Dispose() calls on the same lease for
200 iterations; asserts count is exactly 0 after each race and a subsequent
single-subscriber AttachEventSubscriber succeeds.

src/ZB.MOM.WW.MxGateway.Server/Grpc/EventStreamService.cs

@@ -53,7 +53,10 @@ public sealed class EventStreamService(
                 $"Session {request.SessionId} was not found.");
         }
 
-        using IEventSubscriberLease subscriber = session.AttachEventSubscriber(
+        // No `using` here — subscriber.Dispose() is called exactly once in the finally
+        // block below, which also disposes the reader. A `using` declaration would add a
+        // second Dispose on the same path and double-decrement the session subscriber count.
+        IEventSubscriberLease subscriber = session.AttachEventSubscriber(
             options.Value.Sessions.AllowMultipleEventSubscribers);
 
         int streamQueueDepth = 0;

src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs

@@ -399,6 +399,10 @@ public sealed class GatewaySession
         IEventSubscriberLease lease = distributor.Register();
         if (startNow)
         {
+            // StartAsync only schedules the pump via Task.Run and returns a completed task;
+            // it does not perform any async I/O itself. The sync-over-async call here is
+            // therefore safe and will not deadlock. Do not make StartAsync truly async
+            // (i.e., await real I/O before returning) without also changing this call site.
             distributor.StartAsync(CancellationToken.None).GetAwaiter().GetResult();
         }
 
@@ -413,7 +417,6 @@ public sealed class GatewaySession
     {
         MxAccessGrpcMapper mapper = _eventStreaming.Mapper;
         await foreach (WorkerEvent workerEvent in ReadEventsAsync(cancellationToken)
-            .WithCancellation(cancellationToken)
             .ConfigureAwait(false))
         {
             yield return mapper.MapEvent(workerEvent);
@@ -1236,7 +1239,10 @@ public sealed class GatewaySession
     private sealed class EventSubscriberLease(GatewaySession session, IEventSubscriberLease distributorLease)
         : IEventSubscriberLease
     {
-        private bool _disposed;
+        // 0 = live, 1 = disposed. Interlocked so concurrent stream-completion +
+        // client-cancellation paths cannot both call DetachEventSubscriber and
+        // double-decrement _activeEventSubscriberCount to -1.
+        private int _leaseDisposed;
 
         /// <inheritdoc />
         public System.Threading.Channels.ChannelReader<MxEvent> Reader => distributorLease.Reader;
@@ -1249,14 +1255,11 @@ public sealed class GatewaySession
         /// </summary>
         public void Dispose()
         {
-            if (_disposed)
+            if (Interlocked.Exchange(ref _leaseDisposed, 1) == 0)
             {
-                return;
+                distributorLease.Dispose();
+                session.DetachEventSubscriber();
             }
-
-            _disposed = true;
-            distributorLease.Dispose();
-            session.DetachEventSubscriber();
         }
     }
 }