conflux: Avoid shutting down tunnel reactor on circuit errors

With the current error handling, I think it's possible for the tunnel reactor to exit if an error occurs e.g. while sending a cell. I think we should revisit this, and avoid using ? in run_once() for circuit-specific operations (such errors should only shut down the affected circuit, not the entire tunnel react

Prompted by this discussion from !3002 (merged)