test: keep the site-2 staging probes alive past the peer they outlive

The amd64 ReleaseSafe SEGV (CI 30606010609) was in the TEST, not the lift. The
Windows trace named it exactly:

    deliverLocalException  (mod.zig:3775)
    forceCancelAllQuestions
    Peer.deinit            (mod.zig:2062)
    ImportOwnerVat.deinitAll -> self.remote.deinit()
    test.L17 site 2 ... -> defer vat.deinitAll()

`stageSite2Provision` deliberately drops the staged call's Return in flight (it
severs the link so the owner's resolved_answers entry stays live, which is the
whole point of the site-2 shape). That leaves the question OUTSTANDING until
`vat.remote.deinit()`, where `forceCancelAllQuestions` delivers a local
exception THROUGH the question's stored `ctx` pointer -- and that pointer was
`&call_probe`, a local of the helper, whose frame died when the helper
returned. `deliverLocalException` then writes into a vanished stack frame: a
segfault on amd64 Linux and Windows under ReleaseSafe, and on arm64 macOS a
silent scribble into a still-mapped page, which is why every local gate and the
arm64 tier passed.

Both probes now live in the test's frame and are passed in, so they outlive the
peer that cancels the question. The helper's doc comment says why, since the
next person will be tempted to tidy them back into it.

Only this helper has the shape: it is the one that deliberately leaves a
question unanswered, and exactly its two tests crashed while the site-1 and OOM
fixtures in the same run stayed green.

The lift's own accounting is untouched by this commit -- `git diff` covers the
test file only. Local gates pass, but they passed before too; amd64 CI on this
PR is the oracle that matters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: nullstyle

tests/rpc/peer/rpc_three_party_handoff_vatc_test.zig

@@ -3024,19 +3024,28 @@ const DeferringService = struct {
 /// provision whose stored target is `.promised` ops naming that answer — the
 /// state the serve arm re-resolves at Accept time. Returns the remote's
 /// import of the deferring service (for teardown).
+/// `bprobe` and `call_probe` are supplied BY THE CALLER, and that is
+/// load-bearing rather than stylistic. The staged call's Return is
+/// deliberately dropped in flight, so its question stays outstanding until
+/// `vat.remote.deinit()` — where `forceCancelAllQuestions` delivers a local
+/// exception THROUGH the question's stored `ctx` pointer. Locals of this
+/// helper would be dead stack by then: `deliverLocalException` writes into a
+/// vanished frame, which on amd64 (Linux and Windows, ReleaseSafe) is a
+/// segfault and on arm64 macOS merely scribbles unnoticed. The probes must
+/// outlive the peer, so they live in the test's frame.
 fn stageSite2Provision(
     vat: *ImportOwnerVat,
     host: *FrameHost,
     deferring: *DeferringService,
+    bprobe: *CapImportProbe,
+    call_probe: *TolerantCall,
     token: []const u8,
     provide_qid: u32,
 ) !u32 {
     _ = try vat.owner.setBootstrap(.{ .ctx = deferring, .on_call = DeferringService.onCall });
-    var bprobe = CapImportProbe{};
-    _ = try vat.remote.sendBootstrap(&bprobe, CapImportProbe.onReturn);
+    _ = try vat.remote.sendBootstrap(bprobe, CapImportProbe.onReturn);
     const service_import = bprobe.import_id orelse return error.ServiceBootstrapFailed;
-    var call_probe = TolerantCall{};
-    _ = try vat.remote.sendCall(service_import, NUMBER_INTERFACE_ID, GET_NUMBER_METHOD_ID, &call_probe, null, TolerantCall.onReturn);
+    _ = try vat.remote.sendCall(service_import, NUMBER_INTERFACE_ID, GET_NUMBER_METHOD_ID, call_probe, null, TolerantCall.onReturn);
     const answer_qid = deferring.question_id orelse return error.CallNotDeferred;
     try std.testing.expect(!call_probe.returned);
 
@@ -3072,7 +3081,11 @@ test "L17 site 2: a stored .promised target re-resolving to an IMPORT is served
     var deferring = DeferringService{};
     const token = try host.mintToken(allocator, "l17-promised-receiverhosted");
     defer allocator.free(token);
-    const service_import = try stageSite2Provision(&vat, &host, &deferring, token, 91);
+    // Declared here, not inside the helper: they back an outstanding question
+    // that `vat.deinitAll()` cancels, so they must outlive it.
+    var bprobe = CapImportProbe{};
+    var call_probe = TolerantCall{};
+    const service_import = try stageSite2Provision(&vat, &host, &deferring, &bprobe, &call_probe, token, 91);
 
     // SITE 2 takes NO Provide-time pin: the target was `.promised` at
     // registration (there was no import to pin yet), so the entry carries
@@ -3150,7 +3163,9 @@ test "L17 witness: a stored .promised target whose re-resolved import has DIED s
     var deferring = DeferringService{};
     const token = try host.mintToken(allocator, "l17-vanished-import");
     defer allocator.free(token);
-    const service_import = try stageSite2Provision(&vat, &host, &deferring, token, 94);
+    var bprobe = CapImportProbe{};
+    var call_probe = TolerantCall{};
+    const service_import = try stageSite2Provision(&vat, &host, &deferring, &bprobe, &call_probe, token, 94);
 
     // The target import dies for real BEFORE the Accept: site 2 has no
     // Provide-time pin (by design — the answer's cap was still a promise at