fix(tls): actor-side thread-local accessors are #[inline(never)] + fence — LLVM caches TLS addresses across context switches (finding 19)

Without LTO (any downstream `cargo build --release`), LLVM keeps `%fs:0` in a
callee-saved register across `switch_to_scheduler`; after the actor migrates,
`ACTOR_DONE`/`PREEMPTION_ENABLED`/`CURRENT_PID` etc. hit the OLD thread's TLS.
8 multi-thread tests aborted with "scheduler resumed a done actor" (error 5).
Thin LTO only worked because it picked the local-exec model.

- context.rs: module doc "Thread-locals and migration" (the rule), tls_fence()
- every TLS accessor reachable from an actor stack is out of line:
  actor::{current_pid, publish_outcome (new)}, preempt::{maybe_preempt,
  check_cancelled, current_slot_ptr, note_*, preemption_swap/enabled (new;
  replaces direct PREEMPTION_ENABLED.with in NoPreempt/RawMutex/with_runtime/
  trace/debug asserts)}, context::{get,set}_scheduler_sp, runtime::{sched_slot,
  slot_push, set_yield_intent}, causal, trace
- raw_mutex order checks: out of line only under debug_assertions
- Cargo.toml: [profile.reltest] = release without LTO; 41 test bins link in
  ~1.5 s each instead of ~12 s (suite 11 min -> 1.5 min) AND it is the
  regression oracle for this bug: `cargo test --profile reltest`
Both profiles: 41/41 + doctests green.

src/scheduler.rs

@@ -85,8 +85,10 @@ use std::sync::{Arc, Weak};
 // released on the wrong thread's copy of the thread-local, corrupting its
 // borrow count. `f` is also always runtime bookkeeping that should run to
 // completion without the actor being suspended or unwound partway through.
+#[inline(never)]
 pub(crate) fn with_runtime<R>(f: impl FnOnce(&Arc<RuntimeInner>) -> R) -> R {
-    let prev = crate::preempt::PREEMPTION_ENABLED.with(|c| c.replace(false));
+    crate::context::tls_fence();
+    let prev = crate::preempt::preemption_swap(false);
     let result = RUNTIME.with(|r| {
         let b = r.borrow();
         let inner = match b.as_ref() {
@@ -95,17 +97,19 @@ pub(crate) fn with_runtime<R>(f: impl FnOnce(&Arc<RuntimeInner>) -> R) -> R {
         };
         f(inner)
     });
-    crate::preempt::PREEMPTION_ENABLED.with(|c| c.set(prev));
+    crate::preempt::preemption_swap(prev);
     result
 }
 
 // Borrow the runtime if present, otherwise `None`. Used on cleanup paths
 // (e.g. a channel's Drop impl during teardown) that may run after the
 // runtime has already gone away. Same preemption gate as `with_runtime`.
+#[inline(never)]
 pub(crate) fn try_with_runtime<R>(f: impl FnOnce(&Arc<RuntimeInner>) -> R) -> Option<R> {
-    let prev = crate::preempt::PREEMPTION_ENABLED.with(|c| c.replace(false));
+    crate::context::tls_fence();
+    let prev = crate::preempt::preemption_swap(false);
     let result = RUNTIME.with(|r| r.borrow().as_ref().map(f));
-    crate::preempt::PREEMPTION_ENABLED.with(|c| c.set(prev));
+    crate::preempt::preemption_swap(prev);
     result
 }
 
@@ -758,14 +762,13 @@ pub struct NoPreempt(bool);
 
 impl NoPreempt {
     pub fn enter() -> Self {
-        let prev = crate::preempt::PREEMPTION_ENABLED.with(|c| c.replace(false));
-        NoPreempt(prev)
+        NoPreempt(crate::preempt::preemption_swap(false))
     }
 }
 
 impl Drop for NoPreempt {
     fn drop(&mut self) {
-        crate::preempt::PREEMPTION_ENABLED.with(|c| c.set(self.0));
+        crate::preempt::preemption_swap(self.0);
     }
 }