No runtime validation in free_unrl against out-of-range/double-free (KASSERT-only, defense-in-depth)

Summary

free_unrl (subr_unit.c:556/597/606): validates item only via KASSERT which compiles out in non-DIAGNOSTIC production. Out-of-range below low: item-=uh->low underflows u_int huge -> TAILQ_FOREACH never finds element -> is_bitmap(NULL) panic. Double-free of item in free run (ptr==NULL): KASSERT skipped free run treated as allocated and split -> tree corruption (wrong ptr/len busy desync) -> subsequent OOB bitmap writes/UAF. No caller passes invalid data today (all 20 callers verified use internally-tracked units). Defense-in-depth: future caller bug becomes memory corruption not clean error. Fix: convert KASSERTs to runtime panic checks.