fix(threadpool): per-task nursery Scope so spawned coroutines can't outlive the task snapshot (UAF)

[EdmondDantes]

Problem

ThreadPool::submit() deep-copies the task closure and every nested closure into a per-task snapshot arena (the bytecode/op_array). The non-coroutine worker freed that arena the instant the task body returned (thread_pool.c task_cleanup) — but any coroutine the task had spawn()ed was still pending in the scheduler. That coroutine's op_array lives in the just-freed arena, so the scheduler later ran it against freed memory:

• 0xC0000005 (hard crash) on the Windows debug heap (0xFEEEFEEE freed-fill).
• Latent on Linux (glibc free() doesn't clobber) — and the server suite has no ASAN job, so it went unnoticed there.

Minimal, server-free repro (crashes before this fix):

$pool = new Async\ThreadPool(1);
$f = $pool->submit(function () {
    Async\spawn(function () { echo "child\n"; });  // pending when the body returns
});
Async\await($f);

Surfaced by true-async/server core/007-server-transfer-handler-dispatch (its task does spawn(stop-coroutine) + $server->start()).

Fix — structured concurrency (nursery)

Run each task body under its own per-task Scope in NOT-safe mode. Async\spawn parents to the current coroutine's scope, so coroutines the task spawns now land in task_scope. On task exit the worker:

1. restores its own scope,
2. cancels task_scope (NOT-safe → stragglers are cancelled, never awaited as zombies),
3. awaits the scope's teardown — ZEND_ASYNC_WAKER_NEW + zend_async_resume_when(&task_scope->event, …) + SUSPEND, mirroring Scope::awaitAfterCancellation at the C level,

…all before the snapshot is freed. So no spawned coroutine can outlive the snapshot. Un-awaited children are cancelled at task exit (bounded by the runtime cancellation grace); a task that wants a child to finish must await it.

Verification (Windows Debug_TS)

• core/007-server-transfer-handler-dispatch: red → green
• minimal repro: no longer crashes (exit 0)
• ext/async/tests/thread_pool/: 65 pass / 0 fail (incl. the flock(): stack-use-after-return when coroutine is cancelled mid-flock (real ASAN finding) #146/ThreadPool/ThreadChannel: no test coverage for transferring $this-bound closures (incl. method-as-closure) #154 lifetime tests) — no regressions
• new regression test tests/thread_pool/065-task_scope_nursery_no_uaf.phpt (will trip ASAN on Linux without the fix)

Follow-up (not in this PR)

Coroutine-mode submit already runs each task in its own task_scope, but frees the snapshot on the task coroutine's dispose rather than on scope completion — the same latent UAF (a coroutine-mode minimal repro also crashes today). Tracking separately.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!