vbus_ext->timer never drained before vbus_ext is freed at shutdown: os_timer_for_ldm() fires on freed memory (UAF)

Summary

The periodic LDM timer is armed via non-synchronizing callout_stop+reset, but the only vbus_ext free site (hpt_shutdown_vbus) never stops/drains it - the callback can execute post-kfree, deref freed vbus_ext->vbus and run ldm_on_timer on a freed PVBUS during the shutdown window. Distinct object from DF-4369 (per-CCB timeout vs per-vbus ldm timer). Hardware-gated. callout_stop_sync-before-frees fix.