fix(js/net): serialize subscription updates with group pops

[kixelated]

Summary

• serialize SUBSCRIBE_UPDATE handling and cap-aware group reads under one publisher state owner
• make the group pop and frame-range snapshot one synchronous operation, closing the residual microtask race from js/net: publisher bounds snapshot is not atomic with the group pop (residual race) #2808
• bump @moq/net from 0.3.1 to 0.3.2

Root cause

recvGroup() removed a buffered group synchronously, but the publisher snapshotted mutable frame bounds in a later promise job. A buffered SUBSCRIBE_UPDATE could run between those steps and serve the group under bounds it was never taken under.

Public API changes

None. The synchronous group receive and readiness hooks are package-internal.

Test plan

• nix develop --command just check
• nix develop --command just test
• focused publisher and track tests covering control-before-pop and pop-before-control ordering

Closes #2808.

(Written by GPT-5)