[kernelshard]

When proxying in ServeHTTP, if the visitor disconnected early, the background routine copying from the laptop remained blocked indefinitely because the opposite socket was never closed on EOF, leaking descriptors.

This PR:

• Uses sync.WaitGroup to symmetrically run and wait for both copy routines.
• Explicitly closes the opposite socket when either direction finishes, unblocking the sibling routine.
• Renames clientConn to visitorConn in ServeHTTP to eliminate naming ambiguity.
• Adds a unit test verifying the tunnel socket unblocks immediately with EOF when a visitor disconnects.

Fixes #58