DF-0753 FIXED-code-path harness
mpls_output/mpls_swap/mpls_pop now take struct mbuf **mp
and propagate the new head through *mp.

--------------------------------------------------------
Scenario A (FIXED): PUSH leading_space=2, if_output success
--------------------------------------------------------
  mpls_forward: m=0x8004b12c0 (head, m_flags=0x2)
  if_output: received LIVE mbuf 0x8004b1230 (m_len=4 flags=0x4002)
         (correct head with M_MPLSLABELED — FIX works)
  mpls_forward: forwarded OK

=== A FIXED: PUSH no-headroom, success ===
  allocs=2 frees=2  double_free=0  uaf=0
  PASS: no double-free (fix eliminates stale pointer)

--------------------------------------------------------
Scenario A2 (FIXED): PUSH no-headroom, if_output ERROR
--------------------------------------------------------
  mpls_forward: m=0x8004b11a0 (head, m_flags=0x2)
  if_output returned -1
  mpls_forward bad: m_freem(0x8004b1110)

=== A2 FIXED: PUSH no-headroom, if_output error ===
  allocs=2 frees=2  double_free=0  uaf=0
  PASS: no double-free (fix eliminates stale pointer)

--------------------------------------------------------
Scenario B (FIXED): SWAP m_len=2 -> m_pullup
--------------------------------------------------------
  mpls_forward: m=0x8004b1080 (head, m_flags=0x4002)
  mpls_output returned -2
  mpls_forward bad: m_freem(0x8004b0f60)

=== B FIXED: SWAP fragmented ===
  allocs=3 frees=3  double_free=0  uaf=0
  PASS: no double-free (fix eliminates stale pointer)

=========================================================
FIXED harness complete.
RESULT: ALL scenarios PASS — fix eliminates stale pointer.