harden(lifecycle): purge consumer callbacks on module unload (crash safety)

Mirror SourceMod SendProxyManager's OnPluginUnloaded purge. Each per-client
callback records its owning assembly (delegate's declaring assembly); on
OnLibraryDisconnect the manager purges that module's callbacks, so the send
path can never invoke a delegate into an unloaded AssemblyLoadContext (the
main server-crash vector for a consumer hot-reload/unload).

Entity removal already clears entity-scoped regs (OnEntityDeleted); the
per-client path stores no per-client state (transient [ThreadStatic] recipient)
so disconnect needs no cleanup; dispatch is stateless + IsUserPtr-gated +
Unsupported-passthrough. README documents the lifecycle guarantees.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>