last_td tracking field uses non-atomic plain load/store racy on SMP

Summary

s->last_td plain stores(:112,:127,...) read in ASSERT_SERIALIZED(serialize.h:60). No barrier vs atomic bit. last_td set -2 BEFORE atomic release(:139). Stale/torn on SMP -> false assertion results. Debug-only no production impact.