LAND-1527 Retry and backoff on crashes to prevent DDOS

@Fang- added missing leave, but unsure how to test since we don't have a way to trigger an unsubscribe from a group we don't have yet so might need your help there.

I wouldn't be super concerned with testing that, in this case it's plainly visible from the code that we always emit a leave.

But also: the dumb version of that test is testing the library directly. That is, calling the +unsubscribe from the library with any argument, in any context, and seeing that a %leave gets sent despite the subscription not being in the provided state. You don't strictly need to go through an agent, when all you want to do is test library behavior.

I do still notice a lack of +unsubscribe calls in /app/channels. It has a bunch of "naked" %leaves, and one remaining "naked" %watch. Probably want to be consistent about doing every un/subscription through the library, even if the delay case isn't relevant for some particular ones.

Lastly I'd consider adding a little comment at the top of the file explaining that all subscriptions must be managed through the library. Or pointing that out at the /+ of it, or something similar. Just so contributors (internal ones too) are more likely to catch on.