heap-use-after-free: cross-suite thread-slab vs tree-sitter teardown (test-runner pipeline mem) #852

Found during the keystone memory PR build (2026-07-04), proven pre-existing (reproduces with that PR's mem.c change reverted; none of its files are in the faulting path).

Repro: ./build/c/test-runner pipeline mem (ASan build). Each suite passes ALONE; the UAF only fires in this cross-suite ordering.

Fault: heap-use-after-free — ts_lexer_goto (vendored tree-sitter lexer.c:150) reads memory freed by cbm_slab_destroy_thread (slab_alloc.c:219), originating from test_mem.c:662 slab_tier1_malloc_backed. Looks like a thread-local slab is destroyed while a tree-sitter parser/lexer from a prior suite still references slab-backed memory — a teardown-ordering / lifetime bug between the custom thread-slab allocator and tree-sitter's parser state.

Reproduce-first TODO: isolate into a minimal RED test (one slab-backed parse + thread-slab destroy while the tree/lexer is still live) rather than relying on suite ordering; then fix the teardown ordering (destroy parsers before the thread slab, or detach slab-backed buffers). Memory-safety bug → priority/high.