r457 free the copy staging snapshot only on consumption/slot-reuse/skip/TTL (not on opdef_clear)

The r456 change kept the snapshot alive across opdef APPLY, but the r457
mode-C run proved a second freer: svc_opdef_clear's FINISH path (entry
consume via svc_replay_note) freed the b1 H2D's snapshot while the copy
was still owed. The pin-batch rewind then REPLAYED the entry, the
re-capture read the driver's REFILLED staging and the deferred execution
wrote b2's bytes into db1.

Evidence (r457, mode C, owner 0x5c00005c/1/0627e693d05aab3f):
 191607.816388 copy snapshot captured dst=0x72e318c20000
   src=0x72e31c400000 first4=00000000 3e800000 3f000000 3f400000 (b1)
 191608.798838 copy snapshot captured <same key>
   first4=00000000 3d800000 3e000000 3e400000 (b2 - refilled staging)
 191611.404931 sema-bigcopy dst_va=0x72e318c20000 src_va=0x72e31c400000
   dst16_after=000000000000803d0000003e0000403e (b2 landed in db1)
The op never succeeded (rc=-2 every pass), so the only free that could
have dropped the first snapshot is the opdef_clear owner free.

New lifecycle: capture once -> free on the copy's own successful
consumption -> free on ring-slot reuse with a new push hash -> free when
a re-decode skips an already-done op -> 30 s TTL. svc_copy_snap_free_owner
keeps its rationale but is no longer called (the r444 cross-entry
poisoning stays closed by the owner key + eviction).

0 files changed, 0 insertions, 0 deletions