Fix double-free when a comparator panics mid-split_off

[jonbaldie]

r? Darksonn

Root::split_off currently interleaves search_node (which invokes the caller's Ord/Borrow impl and can panic) with move_suffix, which physically relocates key-value pairs into a temporary right-hand tree one level at a time. If the comparator panics on a level after the first move_suffix, unwind drops that right-hand tree while self.length is still the old, too-large value. IntoIter trusts that length and can double-free.

This is rust-lang#158165 (I-unsound). A comparator panic is allowed (e.g. RefCell::cmp); it must not become UB.

Approach

Previous attempts (rust-lang#158710, rust-lang#160901) aborted after the first move. That is sound, but it cannot host the issue's catch_unwind reproducer as a regression test (requested on rust-lang#158710), and it turns a recoverable RefCell panic into a process abort.

This change splits split_off into two passes:

1. Walk root-to-leaf recording the split edge index at each level. This is the only pass that calls Ord. The tree is not mutated, so a panic leaves self intact.
2. Replay those indices with move_suffix, then fix borders as before. Ord is not invoked here.

Validation

• Standalone repro from the issue on rustc 1.83: len=12 reachable=6, then free(): double free detected.
• Minimised: 12 keys (CAPACITY+1, min height 1), original insertion order, panic on cmp(6, 0). Height-0 (11 keys) already unwound cleanly.
• Probe of comparisons during the panicking split_off: [(6, 6), (6, 0)] — first search at the root succeeds and moves the suffix; second search panics.
• After the fix, the same repro against stage1 std recovers with len=12 reachable=12 and into_iter().nth_back(5) no longer double-frees.
• ./x.py test library/alloc: 336 unit tests passed (including the two new regression tests), plus the rest of the alloc suite.

Fixes rust-lang#158165

AI/LLM disclosure

• AI coding tools (including Cursor Grok) were used to help draft or modify code and this PR description.
• I reviewed the complete change, understand the reasoning, and ran the reported local tests before submitting.
• This submission is original work of authorship under the project CLA / contributor terms; AI output was not pasted unreviewed.