sysctl_kern_consmute races cnread/cnwrite/cnioctl forwarding (no lock)

Summary

consmute(:257-299) reassigns cn_fwd_ops/cn_dev via cninit_finish/cnuninit. cnread/cnwrite/cnioctl(:446-498) check-then-forward cn_fwd_ops with no token. Race: NULL check passes, consmute invalidates, dispatch on stale/freed ops. Root-only.