[EinBexiii]

The verifier closure captured the admission key and go-nethernet keeps that closure on the Conn, so the key stayed in memory for the whole session even though it's only needed for the one identity check at login.

The key now lives on the attempt and is released once the login is verified, its deadline passes, setup fails, the game reports an outcome or the connection closes. A verification after release fails with "admission no longer pending", the deadline case keeps "admission expired before login".

This follows the binding lifecycle in the wire reference: "Retain the actual admitted key epoch until comparison, channel closure, rejection or the ticket's login deadline."

Tested in TestVerifierReleasesKey.