docs(gc)+cli: cwist_gc_scope_flush contract and hazard warnings (#347)

[gg582]

Addresses the documentation and tooling items of #347.

Why

The cwist_gc_scope_flush() comment in gc.h told callers to flush "at the end of each unit of work … (a request, a queued job)". fly.board followed that advice from a request middleware. That is unsafe for two reasons:

1. A flush retires every block the thread still tracks, live or not. That includes the response being built and, on a connection thread, h2 session state.
2. Retired blocks are freed only when something drives reclaim. Request-serving threads never enter an epoch, so once reclaim runs it frees retired blocks even while they are in use. In fly.board nothing ever drove reclaim, so the flush freed nothing and leaked one retire node per block. It would have turned into a use-after-free the moment anything started reclaiming.

The middleware has since been removed from fly.board (gg582/fly.board@db27855) and redeployed.

Docs (aab01576)

• gc.h:
  • cwist_gc_scope_flush() now states its precondition (the thread holds no live tracked block), lists where it is and is not OK to call, and explains the reclaim dependency.
  • cwist_conn_registry_flush() now warns that it closes connections other threads are still serving.
  • cwist_conn_registry_untrack() no longer claims it searches only the caller's list (segfault (UAF) in cwist_http_header_get (http.c:1575): forked connection handlers die mid-request, clients see timeouts #344 changed that).
  • Comment-only changes; no signatures change.
• docs/GC.md and docs/ko/GC.md: new section 7, Explicit flushes and reclamation, with an OK / not-OK table and the ack marker. The summary table's teardown-safety row is corrected: epoch deferral protects only readers inside ttak_epoch_enter().

CLI (8c9f3374)

cwist audit and cwist watcher warn on application calls to:

• cwist_gc_scope_flush
• cwist_ebr_free
• cwist_gc_scope_disown / cwist_gc_scope_untrack
• cwist_conn_registry_flush
• cwist_conn_registry_sweep_all

WARNING: cwist_gc_scope_flush() retires EVERY block the calling thread still tracks, live or not.
  Use it only if you know its contract: call only where the thread holds no live tracked block (end of a self-contained job); never from a handler, middleware, or a thread that is serving connections.
  Read CWIST's docs/GC.md ("Explicit flushes and reclamation") before using it,
  then mark the call with a comment: /* cwist-ack: cwist_gc_scope_flush */
    src/engine/async_route.c:111
    ...

• Adding cwist-ack: <api> on the same line or the line above silences the warning. A single marker can list several APIs.
• CWIST's own tree is not scanned, so cwist audit src in this repo shows only the multiport warning it already showed.
• watcher reports once at startup, then again for each changed .c/.h file.
• audit --json writes the warnings to stderr, so stdout stays valid JSON.

Tests

• scripts/ci/test_cli_hazards.py, 9 cases: detection in .c/.h, ack on the same line or the line above, a wrong-API ack, a multi-API ack, comment and prefix false positives, skipping CWIST's own tree, and the report text. It is picked up by the existing unittest discover -s scripts/ci -p 'test_*.py' CI step.
• test_malloc_gate.py still passes.
• Checked by hand against the fly.board tree: 7 flush call sites and 2 disown call sites are flagged. watcher --once warns once, and the warning goes away after acking.

Not in this PR: the third #347 item, deciding whether full GC should drive reclaim itself.