follow-ups from the RVT1 device gateway review (#305) #312

Four minor findings from the pre-merge review of #305, none blocking:

1. Hello read has no deadline — RivetDeviceAppleRVT1Client.start() reads the post-RVD1 hello without a bounded budget, so a silent authenticated peer holds the session indefinitely. Mirror the RVD1 30-second post-TLS deadline policy.
2. Deny surface half-pinned — DeviceGatewayTests pins invokeRPC("\$state/get") but not \$state/set through the ordinary route, nor an end-to-end gateway $state/set denial.
3. Wedged backend shrinks capacity — cancelledIDs/requestTasks entries are never swept if a backend dispatch task ignores cancellation; bounded by the 64-request cap but permanently reduces effective capacity for that connection.
4. Handshake error typing — pre-hello failures rethrow raw channel/protocol errors instead of the typed RivetDeviceAppleRVT1ClientError surface.