Scan-time enclosure checking can catch most gaps, but Minecraft's own
fluid physics will still spread a water source block into any
adjacent open space it finds - a diagonal/stepped ring corner can
have a path that isn't a "leak" by the scanner's flood-fill rules
(which only ever move orthogonally) but vanilla water flow still
takes, since flow is also orthogonal-only and can find edge cases the
scanner's enclosure proof didn't need to rule out.
Rather than trying to prove every possible ring geometry is leak-proof
at scan time, GateManager now tracks every iris block of every locally
scanned gate (registered at link time, on restart re-scan, and
unregistered on destroy), and a new BlockFromToEvent listener cancels
any fluid spread whose source is one of those blocks. This is the
same technique real portal-style plugins use: containment enforced by
the plugin at the physics level, not by proving the shape is sound in
advance.
Note: this only stops future leaking. Water that already escaped
before this fix needs to be manually cleaned up once.