feat(bevy_matchbox): port to Bevy 0.19 and move the workspace to ggrs 0.13

[AdamWhitehurst]

What

Ports bevy_matchbox to Bevy 0.19 and moves the workspace to ggrs 0.13. Only bevy_matchbox depends on Bevy, so the Bevy surface is three source files; the ggrs floor moves because examples/bevy_ggrs needs bevy_ggrs 0.22 on Bevy 0.19, and that requires ggrs ^0.13. The five published crates go to 0.15.0.

Why

bevy_matchbox 0.14 targets Bevy 0.18 and there is no 0.19 release, so it is what holds a Bevy 0.19 project on 0.18.

Changes

• MatchboxSocket drops its Component derive. Resource is now pub trait Resource: Component, so deriving both is a conflicting impl.
• OpenSocket, CloseSocket, StartServer and StopServer each declare type Out = (), which Command gained.
• Both background tasks stay owned fields. MatchboxSocket keeps Box<dyn Debug + Send + Sync> and MatchboxServer keeps Task<Result<(), Error>>, because dropping a task cancels it and that is what makes close_socket and stop_server stop the work they name. Bevy 0.19 re-exports async_task::Task directly, so this now holds on web as well as native.
• bevy_matchbox/src/socket.rs gains closing_the_socket_cancels_its_message_loop, which builds a socket over a message loop that trips a flag when dropped, removes the resource, and waits for the flag. It fails if the task is detached.
• The doc examples stop teaching the component pattern. new_unreliable and new_reliable insert the socket as a resource, and the type-level "As a Component" example goes. They still compiled, since Resource implies Component, which is why the compiler did not catch them.
• matchbox_socket takes ggrs ^0.13 in both dependency tables. The source needs no change, since impl NonBlockingSocket<PeerId> for WebRtcChannel still matches the trait.
• examples/bevy_ggrs takes bevy 0.19 and bevy_ggrs 0.22. A rollback entity takes a Rollback component, with_num_players returns a Result, and TextFont names its font and size through FontSource and FontSize.
• A workspace lint table allows result_large_err and collapsible_match. Both predate the lints that report them. Rejecting a websocket upgrade returns an axum Response, and boxing it would change a public callback signature.
• README.md gains the 0.19 | 0.15, main compatibility row.

Before / After

	0.14	this branch
bevy	0.18	0.19
ggrs, via matchbox_socket	^0.11	^0.13
bevy_ggrs, in the example	0.20	0.22
MatchboxSocket	Resource and Component	Resource

Verification

cargo test --features signaling --all-targets, cargo test --doc and cargo clippy --features signaling --all-targets -- -D warnings pass on stable 1.97.1, along with the wasm check over matchbox_socket, bevy_matchbox, bevy_ggrs_example, simple_example and custom_signaller. cargo tree -i ggrs reports one version.

hello_host and hello were run against each other. The host logs a connected peer and both processes exchange their periodic messages, so data channels open on IoTaskPool with no tokio runtime. A downstream project also connects two peers over its own signaller with this branch as a path dependency.

Relationship to #556

#556 covers the same Bevy 0.19 migration and this branch was written against upstream main instead of taken from it, so the two differ where it made different calls. #556 detaches both background tasks, which is what the owned-task test here asserts against, and drops MatchboxSocket's second field. It also moves the native message loop onto a dedicated tokio runtime because data channels never open with webrtc-rs 0.17; that symptom did not reproduce here, so this branch leaves the loop on IoTaskPool. Happy to fold either way if the maintainers prefer #556's shape.