fix(pool): prevent num_idle underflow that wedges maintenance in a CPU spin

[nipunn1313]

Fixes #3645 - A rare 100% CPU and a hang on shutdown.

I made this fix w/ the assistance of an LLM, but I was looking quite carefully to make sure the code changes make sense.

I opted to repro via a stress test - which shows the underflow if you run the test without the fix.

At Convex - we run an hourly job that makes heavy use of sqlx with idle connection configuration. Something like once a week or two, we run into this, where it hangs on shutdown with 100% CPU. I was able to profile traces and narrow down the issue.

Leaving an LLM generated description down below in case you find it helpful.

---

PoolInner::release made a returned connection acquirable (push to the idle queue + release its semaphore permit) before incrementing num_idle. A concurrent pop_idle (via try_acquire) could pop that connection and run its num_idle.fetch_sub(1) in the window before the increment landed; if num_idle was 0 at that moment the usize wrapped to usize::MAX.

The background maintenance task builds its sweep range from for _ in 0..pool.num_idle(), and once the idle queue drains the loop body is fully synchronous (try_acquire/release never .await). So a single bad read of usize::MAX makes the task spin ~10^19 iterations without yielding, pinning a worker thread forever and never observing the pool close. This is wide open on shutdown, where dropping every PoolConnection spawns a release, racing the maintenance tick. A MultiDbPool (one pool per database) wedges several tasks at once, pegging every worker thread — the reported 100%-CPU-on-shutdown symptom.

Fixes, in sqlx-core/src/pool/inner.rs:

• release: increment num_idle before publishing the connection. With this order each completed push is preceded by its fetch_add, so #dec <= #pop <= #push <= #inc and num_idle = #inc - #dec >= 0 always. Transient over-counting is harmless (pop_idle finds an empty queue and returns the permit without decrementing). The permit is still released after the push, preserving the woken-waiter-sees-the-connection invariant.
• pop_idle: saturating decrement, so a stray fetch_sub can never wrap even if a future change reintroduces an ordering bug.

Adds a multi-threaded stress test that drives the real try_acquire and release paths on a small, heavily oversubscribed pool (using the in-crate Any database with a stub backend, so no DB or runtime is needed) and asserts the sampled num_idle never exceeds max_connections. It catches the wrapped usize::MAX reliably on the original code (5/5 debug, 3/3 release runs) and passes with the fix.

[nipunn1313]

would take advice on how to write the test here - this is a bit gnarly, but it worked.