feat(state): owning accessors + pinned resolveLink — fix cross-node UAF (lifetime Phase 1)

[transfix]

Phase 1 / Option A of the merged design docs/roadmap/STATE_LIFETIME_AND_ATOMICITY.md (#486). Closes the cross-node use-after-free in cvc::state.

The bug

operator() returns a bare state& and findDescendant() a bare state*, whose only owner is the parent's _children map. A concurrent sweepExpired() (the sole production node-freeing path) can free a node under a caller still holding the bare reference — a UAF. The confirmed trigger (adversarial review "H1"): a state://… resolve on a compute-pool worker calling eff->fullName() while a tree-wide sweep on the scheduler/pycvc thread orphans an intermediate ancestor.

Core (state.h / state.cpp)

• state now derives boost::enable_shared_from_this<state> (boost variant, matching state_ptr = boost::shared_ptr<state>; std's would throw bad_weak_ptr). Zero minting changes — every live node is already shared_ptr-owned.
• findDescendantShared(path) — owning analogue of findDescendant: copies the map's shared_ptr at each hop, so the result is pinned (a concurrent sweep can only unlink it, never free it under the caller).
• sharedChild(name) — owning create-or-get analogue of operator() (same lock/create semantics).
• state::handle — thin RAII pin.
• resolveLink now pins its walk (each hop held as a state_ptr) and returns the terminal pinned in link_resolution::target_owned.

Resolver (uri_state.cpp)

state_resolve / state_store now pin the addressed + effective node and build canonical from path strings (the input path, or resolveLink's captured visited chain) instead of a post-resolution eff->fullName() — the exact walk that UAF'd on an orphaned node.

Scope / residual

operator() / findDescendant are unchanged — Option A is an opt-in owning accessor, not a transparent upgrade (changing their return type would break fluent chaining + 82 call sites). The pin covers a node's own storage, not its ancestor chain, so fullName()/parentName() on a pinned-but-orphaned node stays unsafe; resolveLink's internal fullName() during the walk is the narrower remaining window — both tracked with the fullName hardening (Phase 3 / the design's open questions). Multi-node atomicity is Phase 2 (the cache keeps cache_mutex until then).

Test — state_lifetime_stress_test.cpp

• PinDefersDestruction — a sweep unlinks synchronously, but a held pin defers ~state/destroyed to the last owner (Option A's one observable change; keeps state_expiry_test green since it holds no pin).
• PinnedLeafSurvivesAncestorSweep — the H1 core: a pinned leaf reads safely after its intermediate ancestor is swept (a bare state* would UAF here).
• SharedChildCreatesAndPins, ConcurrentPinnedReadVsSweep (4 readers pin+read while a sweeper churns the subtree; no UAF).

All pass locally; the concurrent case is meant to run under TSan (setarch -R) + ASan in CI.