queue: keep fallback timeout data alive until submission

[soul-sol]

On kernels without IORING_FEAT_EXT_ARG, the timeout fallback places the caller-owned timespec pointer in an IORING_OP_TIMEOUT SQE. _io_uring_get_cqe() could return an already available CQE before SQPOLL consumed that SQE, or before a short non-SQPOLL submission reached it. The caller could then release stack storage while the ring still held the pointer.

Track the SQ tail containing the fallback timeout and keep submitting/waiting until the kernel SQ head reaches it. If a synchronous submission fails first, retract the last timeout SQE so a later submit cannot use the pointer. Other get-CQE paths retain their existing behavior and return values.

The regression test idles an SQPOLL thread, fills a 32K SQ without publishing it, forces the pre-EXT_ARG fallback, and verifies the call cannot return with unconsumed SQEs. It fails on current master with 32768 SQEs still ready and passes with this change.

Validation:

• Full liburing test suite on Linux 6.12: all tests passed
• ASan/UBSan: submit-and-wait, timeout, timeout-new, and defer-tw-timeout passed

Fixes #1164