Fix reference-ownership defects in the bindings

Audit of every place in ext/ where Python reference ownership is asserted by hand, following the leak fixed in eef80a98. Fixes seven more sites of the same family — all leaking only on the throwing path, plus two null-derefs — and replaces the deliberate __Group wrapper leak in group.cpp with proper unique_ptr disowning.

Adds tests/test_reference_leaks.py, which counts leaked objects per call: the valgrind job cannot see a missing decref, and the RSS-plateau check needs a large leak. Verified by reverting each fix and confirming the assertions fire (2.00 objects/call).