Respect transfer stream ownership and IO contracts

[OskarEichler]

Problem: Transfers closed caller-owned streams, uploads required pos/size even though the API accepts readable streams, and an empty successful DATA response could cause downloads to retry forever.

Fix: Track stream ownership and upload offsets explicitly, support streams without seek/size methods, close only library-opened files, and treat empty DATA as EOF.

Regression coverage: Adds focused upstream cases for caller-owned streams, read-only upload streams, and empty DATA. Upload: 11 runs / 86 assertions; download: 10 runs / 89 assertions. Full suite: 435 runs / 1,201 assertions with only the pre-existing Ruby 4 StartTest positional-hash/keyword expectation failure.

[OskarEichler]

I did another pass over the stream contract and covered one additional edge case: a readable object returning an empty chunk is now treated as EOF rather than producing repeated zero-byte SFTP writes. Focused upload/download tests pass (22 runs, 176 assertions). The full suite otherwise reaches 435/436 passing locally; the sole failure is the pre-existing StartTest#test_with_block_and_options keyword/hash expectation under this Ruby/net-ssh combination.