Callout handlers dereference sc_ttyp before NULL check/token: callout-vs-close race panic

Summary

sl_keepalive(:1016)+sl_outfill(:1043) read tp=sc->sc_ttyp BEFORE acquiring token and with NO NULL guard. slclose zeroes sc_ttyp(:325) after callout_stop(:317/:321). If callout already dequeued for dispatch when slclose runs fires after sc_ttyp=NULL -> lwkt_gettoken(&tp->t_token) computes near-NULL token address -> fault. Requires root(slopen SYSCAP_RESTRICTEDROOT)+keepalive/outfill configured. Fix: acquire tty_token first re-read sc_ttyp under token NULL-check.