unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race (CVE-2026-46690) | HOL Guard CVE