acpi_hp_notify / acpi_hp_evaluate_auto_on_off run without the hp serial lock, racing sysctl handlers on softc state

Summary

Notify is dispatched after the acpi_wmi lock is released and never takes ACPI_SERIAL(hp); evaluate_auto_on_off reads/writes was_wlan/bt/wwan_on_air unsynchronized while every sysctl handler mutates the same fields under the lock. DF-2383 covers lifetime; this is the distinct serialization defect - lost/duplicated radio on-air notifications, benign int races, no memory-safety consequence. Lock-bracket fix.