lagg_clone_create error path calls if_free on embedded ifnet: latent double-free if protocol attach ever fails

Summary

lagg_clone_create(:304-347): ifp=sc->sc_ifp=&sc->sc_if is EMBEDDED in lagg_softc. Destroy path correctly comments "dont free it!" and skips if_free(:435-436). But create error path(:343-346) calls if_free(ifp) THEN kfree(sc) -> double-free of embedded ifnet resources + slab corruption. Currently unreachable: only proto (FAILOVER) ti_attach always returns 0. Latent landmine for any future failing ti_attach.