Closes #30556

When tls.connect({ socket }) receives a non-net.Socket stream (e.g. mssql/tedious wrapping TDS framing in a Duplex via native-duplexpair), Deno creates a JSStreamSocket to bridge the JS stream to Rust TLS resources. A circular Rc dependency between JSDuplexResource and JSStreamTlsResource prevented either from being dropped after close, keeping a pending core.read() alive and the event loop running indefinitely.

Fixes at three layers:

• (tls.rs): Add Resource::close() to JSDuplexResource using AtomicBool + tokio::sync::Notify to break pending reads without mutex deadlock, releasing the circular Rc dependency.

• (_tls_wrap.js): Add JSStreamSocket.close() so the _onClose() -> kStreamBaseField.close() path properly closes both TLS and channel resources.

• (stream_wrap.ts): Treat Deno.errors.UnexpectedEof as EOF alongside Interrupted and BadResource, fixing a pre-existing unhandled error on TLS peer close.