When the workflow lease expires for `pam tunnel start` or `pam launch`,
soft-close the tube now and escalate to keeper_pam_webrtc_rs's new
force_close_tube after 3s. Force-close drops the local TCP listener and
severs in-flight forwarded TCP streams (SSH, MySQL, etc.), which the
prior soft-close did not — an active session would linger past expiry
until the user disconnected manually.

Escalation is gated on both endpoints supporting force_close_tube:
hasattr(tube_registry, "force_close_tube") on the local crate AND
remote SDP-advertised version >= FORCE_CLOSE_MIN_VERSION ("2.1.18").
Older peers fall back to soft close only.

- tunnel_helpers: add escalate_close() shared helper plus
  FORCE_CLOSE_MIN_VERSION / FORCE_CLOSE_DELAY_SECONDS constants;
  consolidate _version_at_least here as the single source of truth
  (terminal_connection.py re-exports for back-compat with launch.py)
- tunnel_and_connections: replace the previously-commented-out soft
  close in `pam tunnel start`'s lease-expiry callback with escalate_close
- pam_launch/launch: wire escalate_close into `pam launch`'s
  _on_lease_expired (was only setting flags before, no tube close)