Leave event missing from state_after

### Description

When a client leaves a room on a homeserver where https://github.com/matrix-org/matrix-spec-proposals/pull/4222 is enabled, the leave event doesn't appear in the `state_after` (or `org.matrix.msc4222.state_after`). I believe it should do because `state_after` should duplicate all state events from the timeline section that apply at the end of the point the sync covers.

Response from `beta.matrix.org` (with MSC4222 enabled):
```
"leave": {
"!CdHcMUhjzlGJQr299cjiQZgJNFdQtmAUJlIamKQ7pvg": {
"timeline": {
"events": [
{
"type": "m.room.member",
"sender": "@davetest:beta.matrix.org",
"content": {
"membership": "leave"
},
"state_key": "@davetest:beta.matrix.org",
"origin_server_ts": 1754658410215,
"unsigned": {
"replaces_state": "$gORoiLnG_h2mWrKoW4jhjvvXGFj39ReLdV-fq4w4bOc",
"prev_content": {
"displayname": "dave test",
"membership": "join"
},
"prev_sender": "@davetest:beta.matrix.org",
"membership": "leave",
"age": 120
},
"event_id": "$WseXqR8u9P9M2tpf7wahk_QmEp1ogJexRLL41HS5iAs"
}
],
"prev_batch": "s4436051_1_9238_3990099_16270_238_38684_2677914_0_340",
"limited": false
},
"org.matrix.msc4222.state_after": {
"events": []
},
"account_data": {
"events": []
}
}
}
```
Note that the leave event is in the `timeline` section but not in `state_after`.

From `matrix.org` (without MSC4222):
```
"leave": {
"!QnwqAqEkZlreqGleJe:matrix.org": {
"timeline": {
"events": [
{
"content": {
"membership": "leave"
},
"origin_server_ts": 1754658946055,
"sender": "@dave:matrix.org",
"state_key": "@dave:matrix.org",
"type": "m.room.member",
"unsigned": {
"replaces_state": "$xDKAUL61qiMbA6-5ABYRuHEqy5UhCUfrhZk0xTDjzS8",
"prev_content": {
"avatar_url": "mxc://matrix.org/IssHdyiXMcSnRCxCzqoaocGL",
"displayname": "Dave",
"membership": "join"
},
"prev_sender": "@dave:matrix.org",
"membership": "leave",
"age": 1724
},
"event_id": "$H456wIzEatLxS5chZ7aN72E-JkN0XCuQq9bb1XlqLHE"
}
],
"prev_batch": "s6158096937_757284974_4199159_m3882099430~39.3882099443~72.3882099441~38.3882099445_4412080234_266497694_1516505502_11171079150_0_521298",
"limited": false
},
"state": {
"events": [
{
"content": {
"membership": "leave"
},
"origin_server_ts": 1754658946055,
"sender": "@dave:matrix.org",
"state_key": "@dave:matrix.org",
"type": "m.room.member",
"unsigned": {
"replaces_state": "$xDKAUL61qiMbA6-5ABYRuHEqy5UhCUfrhZk0xTDjzS8",
"prev_content": {
"avatar_url": "mxc://matrix.org/IssHdyiXMcSnRCxCzqoaocGL",
"displayname": "Dave",
"membership": "join"
},
"prev_sender": "@dave:matrix.org",
"age": 1724
},
"event_id": "$H456wIzEatLxS5chZ7aN72E-JkN0XCuQq9bb1XlqLHE"
}
]
},
"account_data": {
"events": []
}
}
}
```
...which is also somewhat odd in that I wouldn't expect the leave event to be in the `state` block because in non-msc4222 mode, state events in the timeline block are added to state and don't need to be duplicated, so that's fun. It's not really what this bug is about, but included for context nonetheless.

This causes rooms to not appear as if the user has left them on clients when using MSC4222.

### Steps to reproduce

- Enable MSC4222 in synapse and find a client that supports it (or sync using `org.matrix.msc4222.use_state_after=true`)
- Leave a room

### Homeserver

beta.matrix.org

### Synapse Version

1.134.0

### Installation Method

I don't know

### Database

Unknown

### Workers

I don't know

### Platform

EMS?

### Configuration

_No response_

### Relevant log output

```shell
None
```

### Anything else that would be useful to know?

_No response_

Start by tracing Synapse's sync response generation for leave rooms and the MSC4222 `state_after` handling, using the supplied beta.matrix.org response as the reproduction. Compare the timeline event with the resulting `state_after` events, then verify that a client using `org.matrix.msc4222.use_state_after=true` sees the room as left.

Written by the indexing model from the issue text.