fix(coderd/x/chatd): avoid closing poller hint channels - #28746

…end-on-closed-channel panic

The stream sync poller delivered hints over per-subscriber channels that
unregister closed under the poller mutex, while pollOnce sent on them
from a lock-free snapshot. A subscriber unregistering mid-poll made
pollOnce panic with "send on closed channel", crashing coderd. Any
authenticated user could trigger this by opening and closing chat
streams (GHSA-7x3x-59xg-4hrc).

Convert the poller to a callback fanout, mirroring pubsub.Subscribe:
Register now takes a deliver callback and returns only an unregister
func, unregister is delete-only (nothing is ever closed), and the
consumer funnels poller hints into its existing consumer-owned updateCh
with the same streamCtx guard already used for pubsub hints. This makes
the panic unrepresentable and also removes the nil-poller closed-channel
return that instantly terminated streams via the ok-check.

Adds a regression race test churning register/unregister against
pollOnce; the previous implementation panics under it.