heap: clear thread-local error trace before unmapping pools

Pre-existing latent test crash on macOS-debug, surfaced once the
build matrix went green: an earlier test that took an error path
populated g_error_trace (lang/eval.c), then ray_heap_destroy
munmap'd the pools backing it, leaving the static pointer dangling.
The next test's ray_eval_str called ray_clear_error_trace, which
dereferenced the now-freed pointer and tripped AddressSanitizer.

  test_datalog.c
    datalog/agg_parse_count_scalar (line 786)
      ray_eval_str("(rule (wcount ?n) (count ?n weight))")
      -> ray_clear_error_trace
      -> ray_release(g_error_trace)
      -> SEGV cow.c:50

macOS asan unmaps freed pages so the deref crashes; Linux asan
leaves them mapped, which is why ubuntu-debug stayed green.

ray_heap_destroy now calls ray_clear_error_trace as the very first
step, while the pools are still mapped.  Forward-decl in heap.c
keeps the layering intact (no #include of lang/eval.h from mem/).

Pre-existing bug — not caused by the fused-correctness branch.
The build-failure cascade kept the macOS-debug Test step from
running until now.

Author: singaraiona

src/mem/heap.c

@@ -1180,10 +1180,22 @@ void ray_heap_init(void) {
     ray_tl_heap = h;
 }
 
+/* Forward decl — released before this heap's pools are munmap'd so a
+ * stale thread-local trace doesn't survive the destroy and crash a
+ * subsequent ray_eval_str → ray_clear_error_trace call when the next
+ * heap takes over.  Lives in src/lang/eval.c. */
+extern void ray_clear_error_trace(void);
+
 void ray_heap_destroy(void) {
     ray_heap_t* h = ray_tl_heap;
     if (!h) return;
 
+    /* Drop any thread-local refs into THIS heap's memory before we
+     * unmap its pools.  Ordering matters: release while the backing
+     * memory is still mapped; once the for-loop below munmap's the
+     * pools, dereferencing g_error_trace becomes UB. */
+    ray_clear_error_trace();
+
     uint16_t saved_id = h->id;
 
     /* Unregister from global heap registry */