CCAN: update to upstream after kimi audit.

[rustyrussell]

Lots of changes, so I've summarized the individual upstream commits.

May alter (fix!) CLN behavior:

• 6b4e62ec tal/path: path_simplify() ".." handling
• 4ceeef2b io: don't busy-spin with exclusive conn + pending always plan
• 64822afc io: listener fds O_NONBLOCK
• b02c1147, 2f04573d, 42486358 pipecmd: _exit, pre-fork fd leak, EINTR
• f7062e12, 6da9c78d fdpass: reject-path fd leak, errno sign
• 339b359a breakpoint: blocked-SIGTRAP + fork staleness (--dev-debugger only)
• 018a4977 take: keep labelarr in sync in taken() (debug builds would give wrong taken() error)
• 28f7c3fe check_type: hard-fail (would cause build-time failure)

The rest are not patterns used by CLN, or only happen on allocation failure (which always causes immediate exit):

• 4122d490 tal/str: count regex capture groups via re_nsub, not text scan. No such complex regexes used.
• 5b6fca2c tal: allow tal_steal() to rescue an object being destroyed; we don't do this.
• tal: 9da96c88 (CCAN_LIST_DEBUG only), ca38d33a (notifier edge), 328d96ff (needs type-mismatched tal_expand), 39d1a0a0 (harmless thinko), df66b082 (path_readlink unused), 80416994 (UB never dereferenced), 0e926004 (doc), 3217faca (zero st_size; no /proc reads in CLN), 5d86e1fe (doc)
• c0c9797f str: strcount empty needle - both CLN call sites pass constant non-empty needles
• htable: af8ff95e (init_sized unused), d3da4521 (32-bit), ba8c4ad2 (needs billions of entries)
• opt: 6c3faecc (bare '-' argv), dae5f5f4 (attribute/doc; CLN passes real args)
• timer: f7b21467 (36k years at default granularity), 1127eb30 (needs failing custom allocator - CLN aborts on OOM)
• mem: 351072ac (memcchr unused), dde9474c (fallback memrchr - glibc/musl provide it), 228161d9 (test), f5b48d0f (doc)
• json_out: f14769e3, e9893f9e, d0401012, c91ae47b - all OOM/encoding-error paths; CLN aborts on OOM
• membuf: 4ee105f0 (UB, correct results anyway), 4b2d55b8 (2^62-element buffers)
• rune: cc63dceb (rune_dup unused), 51257cd9 (CLN fieldnames are alnum), fb4dbfa6 (needs embedded-NUL field values)
• strset/strmap iterator rework: b5dcf30e, 19b73d88, 51c4da92, c127ff33 - additive API + recursion fix; CLN's maps are far too small to hit deep trees
• crypto: 1c377ffb (32-bit only), 344ba97c (needs 8160-byte HKDF requests), b4316b44 (default SHACHAIN_BITS=64 immune)
• f2b445b3 str/base32: CLN's one call site passes an exact-size buffer
• intmap 1a1bb440 (sintmap unused), bitmap ab052a14 (2^61 bits), likely 8cfa5f8c (likely_stats unused), take e30e011d (only take_cleanup() on exit), rbuf 748a0692 (rbuf_fill unused), ptr_valid x4 (unused), cdump x3 (cdump_extract unused)
• asort: 0d54244f, a13c9b97, d878b036 - fallback/build-hygiene only; CLN on glibc takes the qsort_r path and already compiled
• Doc-only: 2b988863, 3e034139, 8fee253f, e3155f93, 6e830d68, 172ae94c, cbbd603e, 6f0b1b03
• Test-only: 46acc9b6, 9df9809e, 4c23c54c
• 5b2773b2 build_assert: _Static_assert - compile-time only; all 138 CLN uses are constants (same 138-use build check applies as check_type)
• 01fbf784 container_of: NULL+0 UB fix - behavior identical
• 0421034f cppmagic sentinel, 43cfe853 ilog ilog64 - portability/performance only

Changelog-None