pldm/firmware_device: let an external caller decide when run_terminus stops

run_terminus previously looped internally with no way for a caller to end
the session on its own terms short of an error. Add run_until, which takes
a should_continue closure checked once per step; run_terminus becomes a
thin wrapper whose closure never returns false.

A straightforward arm()/run_once() split (returning the persistent
responder listener to the caller across separate calls) doesn't work here:
StackListener borrows responder_transport and implements Drop, so holding
it across repeated &mut self calls is a genuine borrow-checker conflict,
not just an ergonomics question. The closure keeps the listener entirely
inside one call, avoiding that.

run_once_inner takes each field it needs directly instead of &mut self,
since it runs alongside the listener's borrow of responder_transport for
the whole loop; splitting fields is what lets the borrow checker see they
don't actually overlap.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>