feat(channel): migrate Inner to RawMutex; two-class lock order (Leaf -> Channel)

Phase 2 surfaced the hole this closes: channel guards were held with
preemption enabled, so a timeslice switch inside a channel critical
section could release the pthread mutex from a different OS thread (UB).
RawMutex disables preemption for the guard span and is
cross-thread-release sound by construction; poison goes away with it.

The strict single-class leaf rule cannot survive the migration: finalize
clones the supervisor/trap senders and monitor() clones the Down sender,
all under a cold lock, and those senders live in the slot - the nesting
is structural. The leaf check is therefore generalized to two classes:
Leaf (cold locks, free list, stack pool) and Channel. Order is
Leaf -> Channel, at most one of each; both directions of violation are
debug-asserted at the acquisition site. Channel critical sections call
only the lock-free unpark protocol, so the order is acyclic.

Tests: class-ordering unit tests in raw_mutex (allowed nesting + all
three rejected shapes), plus a multi-scheduler integration test driving
channels through monitor churn and actor death so any ordering
regression trips the debug assert instead of deadlocking.

src/channel.rs

@@ -1,9 +1,23 @@
 //! Unbounded MPSC channels.
 //!
-//! Inner state is `Arc<Mutex<Inner<T>>>` so channels can be sent across OS
+//! Inner state is `Arc<RawMutex<Inner<T>>>` so channels can be sent across OS
 //! threads (required for the multi-scheduler runtime where a sender and
 //! receiver may run on different scheduler threads simultaneously).
 //!
+//! ## Why `RawMutex` (Channel class), not `std::sync::Mutex`
+//!
+//! An actor holding a guard with preemption *enabled* can be timesliced
+//! inside the critical section and resume on a different OS thread — the
+//! pthread mutex would then be released from a thread that didn't lock it,
+//! which is UB (Linux futexes happen to tolerate it, but it's not
+//! guaranteed). `RawMutex` disables preemption for the guard's span and is
+//! cross-thread-release sound by construction, closing the hole. It also
+//! cannot poison. Channel locks form their own [`LockClass::Channel`]
+//! (raw_mutex.rs): they may be taken under a cold (Leaf) lock — finalize and
+//! `monitor()` clone senders that live in slots — but nothing may be locked
+//! under them, which the debug build enforces. `recv_match` runs its user
+//! predicate under this lock: keep it cheap, pure, and channel-free.
+//!
 //! Semantics:
 //!   - Senders are clonable; the last sender drop closes the channel.
 //!   - `Receiver::recv` on an empty open channel parks the receiver.
@@ -15,11 +29,12 @@
 //!     parked, the receiver is unparked.
 
 use crate::pid::Pid;
+use crate::raw_mutex::RawMutex;
 use std::collections::VecDeque;
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 
 pub fn channel<T>() -> (Sender<T>, Receiver<T>) {
-    let inner = Arc::new(Mutex::new(Inner {
+    let inner = Arc::new(RawMutex::new_channel(Inner {
         queue: VecDeque::new(),
         parked_receiver: None,
         senders: 1,
@@ -36,11 +51,11 @@ struct Inner<T> {
 }
 
 pub struct Sender<T> {
-    inner: Arc<Mutex<Inner<T>>>,
+    inner: Arc<RawMutex<Inner<T>>>,
 }
 
 pub struct Receiver<T> {
-    inner: Arc<Mutex<Inner<T>>>,
+    inner: Arc<RawMutex<Inner<T>>>,
 }
 
 #[derive(Debug, PartialEq, Eq)]
@@ -59,7 +74,7 @@ impl std::error::Error for RecvError {}
 
 impl<T> Clone for Sender<T> {
     fn clone(&self) -> Self {
-        self.inner.lock().unwrap().senders += 1;
+        self.inner.lock().senders += 1;
         Sender { inner: self.inner.clone() }
     }
 }
@@ -67,7 +82,7 @@ impl<T> Clone for Sender<T> {
 impl<T> Drop for Sender<T> {
     fn drop(&mut self) {
         let unpark = {
-            let mut g = self.inner.lock().unwrap();
+            let mut g = self.inner.lock();
             g.senders -= 1;
             // Wake the parked receiver on the last sender drop regardless of
             // whether the queue is empty. A plain `recv` only ever parks on an
@@ -89,14 +104,14 @@ impl<T> Drop for Sender<T> {
 
 impl<T> Drop for Receiver<T> {
     fn drop(&mut self) {
-        self.inner.lock().unwrap().receiver_alive = false;
+        self.inner.lock().receiver_alive = false;
     }
 }
 
 impl<T> Sender<T> {
     pub fn send(&self, value: T) -> Result<(), SendError<T>> {
         let unpark = {
-            let mut g = self.inner.lock().unwrap();
+            let mut g = self.inner.lock();
             if !g.receiver_alive {
                 return Err(SendError(value));
             }
@@ -117,7 +132,7 @@ impl<T> Receiver<T> {
     pub fn recv(&self) -> Result<T, RecvError> {
         loop {
             {
-                let mut g = self.inner.lock().unwrap();
+                let mut g = self.inner.lock();
                 if let Some(v) = g.queue.pop_front() {
                     return Ok(v);
                 }
@@ -156,7 +171,7 @@ impl<T> Receiver<T> {
     {
         loop {
             {
-                let mut g = self.inner.lock().unwrap();
+                let mut g = self.inner.lock();
                 if let Some(i) = g.queue.iter().position(|v| pred(v)) {
                     // position() found it, so remove() returns Some.
                     return Ok(g.queue.remove(i).unwrap());
@@ -188,7 +203,7 @@ impl<T> Receiver<T> {
     where
         F: Fn(&T) -> bool,
     {
-        let mut g = self.inner.lock().unwrap();
+        let mut g = self.inner.lock();
         if let Some(i) = g.queue.iter().position(|v| pred(v)) {
             return Ok(Some(g.queue.remove(i).unwrap()));
         }
@@ -201,7 +216,7 @@ impl<T> Receiver<T> {
     /// Non-blocking. `Ok(Some(v))` if a message was available, `Ok(None)` if
     /// the channel is empty but open, `Err(RecvError)` if closed and drained.
     pub fn try_recv(&self) -> Result<Option<T>, RecvError> {
-        let mut g = self.inner.lock().unwrap();
+        let mut g = self.inner.lock();
         if let Some(v) = g.queue.pop_front() {
             return Ok(Some(v));
         }