Keep cc_rbptree traversal safe when callbacks mutate auditors

[Dikluwe]

Problem

Traversing live nodes while an auditor callback removes or adds auditors can invalidate nodes still needed by traversal. Per-callback notification state must also survive reentrant notification.

Changes

• Snapshot the initial pointer/data pairs; use inline storage for small traversals and a checked allocated snapshot for larger ones.
• Check pair membership before dispatch: removed pairs are skipped and distinct pairs added during dispatch wait for the next traversal.
• Give each SoBase callback its own shallow SoNotList copy.
• Cover current/other removal, insertion, nested traversal, callback exception and reuse, NULL keys and duplicate pairs, including 33-entry allocated snapshots.

The tree and callback values remain borrowed. Callbacks must keep the container alive. Identical pairs removed and reinserted have no stable occurrence identity. SoNotList copying remains shallow.

The Windows exception fixture disables MSVC's /EHc assumption only for CcRbptreeTraverseTest with /EHsc-, since that C++ fixture deliberately propagates a callback exception through the C API. Production compiler flags are unchanged. This follows the MSVC exception model.

Dependencies — keep as draft

Depends on #772, #813. The diff against master includes the prerequisite stack. The contribution over the reviewed base is linked below; narrow/rebase the PR after its prerequisites are integrated.

Base: c434d067dc8686893ee3dcb9e38123766e365904 (codex/cc-oom-consumers). Review this contribution over its base.

Validation

Linux candidate 99/99 CTests at 43bf8ebee153284c45a4e7699bf3ed4135460c28, with no skips. Dedicated integration lab previously passed 140/140 at f5af03d273139ec12e742007e3e45622f6ac3f8f; that lab count is a separate reviewed snapshot.

Fresh publication gate of all eight exact heads: 35/35 directed and 153/153 total CTests, no skips, at e6687c088077082e6839b4fc39c632d5267b07d8. GCC/Ninja Debug shared build with COIN_THREADSAFE=ON and external Expat, build and compiler temporary files in RAM; Xvfb/software GLX environment. git diff --check passed for the proposed delta. Native Windows/macOS and formal ABI checks rerun on this published head.

The MSVC-only fixture configuration was added after the earlier integration snapshot failed CcRbptreeTraverse with 0xc0000409 on Windows. Linux passed again at this exact head; confirmation of that Windows correction is left to the new native CI run. Production code is unchanged by that test configuration.

Native Windows confirmation — 2026-10-09

Both Windows CI variants (legacy renderer enabled/disabled) passed at this exact head after the /EHsc- fixture correction. The same corrected fixture passed both Windows variants in #823. The preceding pending-Windows statement described the initial publication snapshot.