[Michael McQuade (giraffesyo)]

Three fixes surfaced by the first CI run on canary after #6.

• A tunnel's session is removed before the tunnel is reported closed, so an observer never sees a closed tunnel's session still open. TestRevocationClosesTunnel now samples the registry inside TunnelClosed, which fails every time without the fix (it was racy before).
• The benchmark gate tested about 30 comparisons each at p < 0.05, so roughly one in three runs failed on noise: the canary run failed on the unchanged WebSocket baseline (p = 0.043). Significance is now judged per family of comparisons with Holm's step-down procedure, which bounds the chance of any false failure at 5%. A real regression still fails (10 against 10 samples separate at p ≈ 1e-5).
• release-please starts a repository with no release at 1.0.0 regardless of the manifest. initial-version makes the first release v0.1.0, as the plan says; release-please release-pr --dry-run against this branch proposes 0.1.0.