kern_sigtimedwait() violates the lwp_delsig()/lwp_sigmask locking contract (unlocked mask writes; lwp_delsig fromproc=1 without p->p_token)

Summary

kern_sigtimedwait rewrites lp->lwp_sigmask (SIGFILLSET/DEL/CANTMASK at 1764-1766, savedmask restore at 1807/1828) with neither p_token nor lwp_token held — inconsistent with kern_sigprocmask (p_token) and kern_sigsuspend (lwp_token) — and calls lwp_delsig(lp, sig, 1) at 1836 with fromproc=1 although the inline contract requires p->p_token (signal2.h:74). Ops are per-word atomic so worst case is torn/duplicate/lost signal delivery racing a concurrent lwpsignal (POSIX correctness), not memory unsafety. Hardening/consistency item; token-acquire fix proposed.