Fix use-after-free when a worker is terminated with a fetch in flight - #31692

The pre-existing SAFETY comment at `let vm = unsafe { &mut *vm_ptr }` (line 1220-1221: "unpublished above under vm_lock, so no other thread can dereference it now — `&mut` is exclusive") now reads as contradicted by the PR's own new comment ~33 lines below: "`close()` synchronizes with any in-flight gated enqueue" — i.e., while this `&mut` binding is live across `on_exit()`/`close_all_socket_groups()` and into `close()`, the HTTP thread may be inside a gated section holding `&VirtualMachine` via

Nit: the per-iteration `await inFlight` only resolves via `worker.onmessage` — there's no rejection path, so if the worker errors before posting (load failure, the `fetch` rejecting, etc.) the subprocess hangs at `await inFlight` until the outer 20s/60s timeout with no diagnostic. Per CLAUDE.md ("Tests reviewers reject" → "Wire EVERY failure event … to reject the awaited promise"), and matching the sibling tests in this directory (`worker.test.ts`, `worker-postmessage-transfer.test.ts`), add `wo