...after merging in main, this no longer built, due to the change
removing struct wrappers.

The callback is run without holding c.mu, so we need to acquire it to
mutate the questions table.

I have not (to my knowledge) observed symptoms of this, but spotted it
while debugging something else.

Silly mistake: when a pipelined question failed to send, we were
rejecting the promise for the *original* question, not the new one we
just failed to send -- so when the return message for the original came
back, we got a panic. Solution is to reject q2, not q.

Note that the tests also needed tweaking, because we don't expect no
error, we just don't want a panic -- the error should reflect the
canceled context.