add plumbers, remove `custodian-tidy-all`

In v6.0.1.7, I tried to give a port-flushing job to custodians. They
turned out to be unqualified, so let's try employing specialists.

Thanks to Eli for pointing out the problem with the v6.0.1.7 design:
attaching callbacks to custodians allows a sandboxed task to escape
through the custodian hierarchy. Plumbers avoid this problem by
having no hierarchy.
racket/sandbox: plumber

A sandbox needs it own plumber so that sandboxed code cannot attach an
arbitrary callback to the plumber outside the sandbox. The plumber
outside the sandbox gets a flush callback that tells (within the
sandbox thread) the new plumber to flush.
drracket: plumber for user process

The exit handler in the user process flushes via the plumber,
but maybe DrRacket could do more with the user's plumber, such as
attempting to exit instead of always forcing the old user process to
terinate when the "Run" button is clicked.