Enforce thread affinity for non-thread-safe loop operations

Decision: Valid - reproduced on current main at 22dec6e.

Evidence: With debug mode enabled and the loop running on a worker thread, CPython raises `RuntimeError: Non-thread-safe operation invoked on an event loop other than the current one` when another thread calls `call_soon()`. zuvloop accepts the call. `zig/loop.zig:587-603` protects the producer with a critical section, but the loop-thread consumer is not inside that section.

Impact: On free-threaded builds, unsupported foreign-thread use can race the native ready ring instead of failing at the API boundary. The missing debug diagnostic also hides a common caller mistake on GIL builds.

Next action: Match CPython's debug-mode thread-affinity checks for `call_soon`, `call_later`, `call_at`, and other non-thread-safe operations. Keep `call_soon_threadsafe` as the supported cross-thread path.

Acceptance criteria: A loop running in another thread rejects each non-thread-safe operation in debug mode and accepts `call_soon_threadsafe`.

Start in zig/loop.zig:587-603, then trace the implementations of call_soon, call_later, call_at, and other non-thread-safe operations. Reproduce the debug-mode behavior with the loop running on a worker thread and compare it with call_soon_threadsafe. Done means each unsupported foreign-thread call is rejected in debug mode while call_soon_threadsafe remains accepted.

Written by the indexing model from the issue text.