TigerStyle: eliminate the shared mutable state instead of guarding it.

Move mux + http.Server construction from ServeHTTP into NewHub. After NewHub returns, h.httpServer and h.httpListener are immutable for the hubs lifetime — single writer (NewHub), many readers (ServeHTTP, Stop). No mutex, no atomic, no sync.Once required: the race is gone by construction.

Add a hub package-private assert helper and positive invariants at entry to ServeHTTP and Stop, surfacing programmer-bugs loudly instead of silently UB-ing on a nil httpServer.

Fixes the 3 data races in TestCrossSessionAutosync and the 3 in TestScope_Project_ConcurrentCommits under -race; hub package suite green at -race -count=3. leaf check-in: 8a18ec9ebe user: 41898282+github-actions[bot]@users.noreply.github.com tags: trunk, fix/hub-stop-servehttp-race-tigerstyle