Other IoContexts can queue actions on an IoContext, e.g. to settle
one of its promises, and its delete queue signal task runs them.
Actions run JavaScript, so they need a current IncomingRequest. An
idle actor, such as one holding hibernatable WebSockets, has none,
so the run failed and the signal task aborted the IoContext,
breaking the actor for all its clients. The same happened if the
request ended while the run waited for a lock.

Instead:

- Without a current request, leave the actions queued rather than
  calling run(). Also skip a wake that finds the queue empty,
  because an earlier run already took the actions.
- If the run loses its request while it waits for a lock, which
  run() reports with NO_CURRENT_INCOMING_REQUEST_DETAIL_ID before
  its callback starts, keep the actions queued and leave the
  IoContext alone. Any other failure still aborts the IoContext,
  including an action's own, whatever details its exception carries.
- Have IncomingRequest::delivered() signal the queue if actions are
  waiting, so the next request runs them. Actions are only left
  waiting while no request is in progress, so only a request
  delivered then needs to check.
- Re-arm the signal before running the actions, so an action queued
  during the run still wakes the context.
- Take the actions out of the queue before running them, so one that
  schedules another can't deadlock on the queue's lock. Nothing does
  that today.

A deferred action runs as part of the request it runs under: it
counts toward that request's limits, appears in its logs and traces,
and has no ordering guarantee relative to the request's own handler.
Queued actions keep the objects they act on, such as a settled
promise and its value, alive on the isolate's heap, so its memory
limit bounds the queue.

handle_cross_request_promise_resolution only guarantees that a
promise settles in its owning IoContext, not when, so deferring
keeps that contract. Document the deferral, and that queued actions
are dropped if the IoContext ends first, which is logged as a
NOSENTRY warning at most once an hour. AbortSignal aborts forwarded
to an idle actor are deferred the same way.

The old behavior broke the actor, so we accept the risk of changing
it without a compatibility flag.