Preserve SoCallbackList state when callback insertion throws

[Dikluwe]

Problem

Callback insertion could change the pointer list or ownership registry before all throwing allocations completed, leaving partial state when a C++ allocation threw.

Changes

• Stage the callback array and ownership entries before publishing insertion.
• Preserve existing callback order, invocation, copy ownership and cleanup when insertion fails.
• Register deterministic bad_alloc oracles in CTest for Linux shared builds, with fresh-process fault injection and successful-operation controls.

The guarantee covers throwing C++ allocations exercised by the oracle. It does not turn underlying allocator exhaustion into a recoverable exception or replace Coin's OOM policy. Callback/userdata pointers retain their existing borrowing semantics; class layout and public signatures are unchanged.

Base

Independent contribution over upstream master; no unpublished prerequisite is required.

Upstream master: ca247c1321bce07199ec0f034493977761b3218e.

Validation

Linux candidate 86/86 CTests at ffba47d0b5ff664790ab6277b39dc71c6f07ab65, with no skips. Dedicated integration lab previously passed 140/140 at f26ae1800f9de3a224ba63b34ddad3f704db9d60; that lab count is a separate reviewed snapshot.

Fresh publication gate of all eight exact heads: 35/35 directed and 153/153 total CTests, no skips, at e6687c088077082e6839b4fc39c632d5267b07d8. GCC/Ninja Debug shared build with COIN_THREADSAFE=ON and external Expat, build and compiler temporary files in RAM; Xvfb/software GLX environment. git diff --check passed for the proposed delta. Native Windows/macOS and formal ABI checks rerun on this published head.