interval_tree misuse degrades to unkillable kernel spin or panic instead of a bounded failure — remove() on an empty root NULL-derefs/panics, remove() of a non-member spins forever holding the caller's mutex, iter_next() on a detached sole node loops or returns the removed node

Summary

Assert-or-spin control flow where the rbtree original fails fast: empty-root remove NULL-derefs on production kernels (KKASSERT compiles out), non-member remove spins forever holding the caller's mutex (unkillable livelock), detached-sole iter_next loops or yields the removed node. No live caller trips these today. Bounded-walk + fail-safe fix.