feat(protocol): add shared MID exchange registry

[atc722]

Context

Thank you for clarifying the ownership and landing sequence in #56.

This is the standalone shared MID-registry slice agreed there. Both #36 and
#54 need to correlate tokenless CoAP control messages with pending requests.
Landing that lifecycle once avoids carrying separate read-side and write-side
MID registries before those PRs are rebased.

What changes

• Adds one private MID-indexed exchange registry shared by GET and POST while
  preserving the existing token-indexed response dispatch.
• Atomically registers both indices before sending and avoids reusing a MID
  that is still owned by a live exchange.
• Treats only an exact RFC 7252 four-byte v1 empty ACK or RST as a
  MID-correlated control message.
• Marks an empty ACK as acknowledged without completing the request; GET stops
  retransmitting that MID and waits for the token-correlated separate response
  under the existing overall deadline.
• Stores acknowledgement state on the exchange rather than in the response
  container, so clearing a stale Block2 response cannot discard the ACK state.
• Completes a matching bare RST with SessionError.
• Unregisters both token and MID indices after success, send failure, timeout,
  or RST.
• Drains both indices and wakes affected waiters with SessionClosedError from
  both close() and reader-thread teardown.
• Publishes the closed session state before draining, preventing a request that
  already passed its entry check from registering after the drain.

Scope

This PR intentionally does not include:

• feat(protocol): discover advertised OCF secure ports #36 discovery APIs or its remaining Block2 reassembly policy changes;
• fix(protocol): retransmit and fail fast on the write path #54 POST retry count, backoff, same-MID retransmission, or pacing policy;
• authentication, endpoint selection, ownership transfer, or public API
  changes; or
• MID registration for fire-and-forget ping and Observe traffic.

The existing Block2 duplicate, SZX, ETag, and accumulation semantics remain
unchanged. Moving acknowledgement state outside the response container also
addresses #36 review point 2 without bringing the rest of that PR into this
change.

Validation

• python -m pytest -q: 320 passed in a clean Python 3.13 environment
• focused MID lifecycle, reader-death, pacing, and stale-Block2 tests passed
• git diff --check
• share-safety check
• targeted Ruff check
• wheel and sdist build
• distribution-content verification
• isolated wheel and sdist imports

After this lands, I will rebase #36 and address its remaining review points,
then let @mbillow know that #54 is ready to rebase.

Refs #56