cttyvp() snapshot read of s_ttyvp unsynchronized vs proc_token-held writers

Summary

cttyvp(p) macro(:74-75) derefs p_session->s_ttyvp. Writers use proc_token(tty.c:334). Readers hold at most p_token(ioctl only) or nothing(open,read,write,kqfilter). p_token!=proc_token so no serialization. Pointer reads atomic, vnode pooled not freed -> stale-but-valid vnode not wild pointer. Root cause of DF-0176/0177.