Rewatch can index a retired project root

[lzl51230]

Problem

cbm_watcher_poll_once() snapshots project-state pointers and polls without the table lock. Replacing a watch removes the old table entry but defers its free, so the old snapshot can still invoke the index callback for the retired root. If replacement overlaps that callback, a clean replacement registration may baseline without repairing the graph the old callback overwrote.

The deferred-free change avoids use-after-free but does not provide registration-generation safety.

Suggested fix

Mark removed states retired, skip retired snapshots before callbacks, and force a different-root replacement to synchronize when replacement overlaps an active callback. Add deterministic rewatch/unwatch concurrency tests.

[DeusData]

Thanks for isolating the registration-generation race. This is a high-priority 0.9.1-rc watcher correctness bug independent of SVN support: a retired root must never publish over its replacement. The RED test should deterministically block inside the old callback, replace the registration with a different root, release the callback, and prove both that the retired result is rejected and the replacement is synchronized.