Move close() to when the fd refcount goes to zero

Instead, we do a shutdown() at the point we are currently closing, to
kick off socket teardown while ensuring an fd ref is sufficient to make
concurrent syscalls like epoll_ctl safe.