l2cap_connect() failure paths after l2cap_cid_alloc() leak the CID and leave the half-open channel on l2cap_active_list: socket bricked with EISCONN until close, CID space consumed

Summary

Both post-alloc failure exits (EHOSTUNREACH and the fail: label) reset state and drop the link reference but never release the CID or remove the channel from the active list: the socket returns EISCONN for every subsequent connect until closed, and the CID stays consumed (65471-CID space pressure across sockets). Needs an hci_unit to reach (no Bluetooth hardware in the rig - code-path certainty, honestly untested). CID-rollback fix (mirroring l2cap_detach).