fix: close bug-1401 ctrlstatus leak, bug-1400 jobsub leak; harden bug-1396 harness

bug-1401: xce_free_ctrlstatus(s) was defined as free_CtrlStatus(s), which
only frees the fields inside xce_ctrlstatus_t. The real client reply path
(decode_CtrlStatus_ptr) calloc's the struct itself, so every ctrlstatus call
leaked sizeof(xce_ctrlstatus_t) (120 bytes). Existing unit tests never caught
it because they built/freed the struct via the raw stack-decode + bare
free_CtrlStatus() helpers, never exercising the actual client macro. Fixed
by switching the macro to free_CtrlStatus_ptr(&(s)) and added a regression
test that exercises the real heap-decode path; RED confirmed the exact
120-byte/1-alloc LeakSanitizer signature before the fix.

bug-1400: the originally reported SEGV in cmd_jobsub on malformed positional
input is stale — NULLSTR guards added 2025-11-05 already reject it cleanly.
The real residual defect was submit.start_info leaking on all 4 early-return
validation paths; fixed by routing them through a shared `goto cleanup`
(matches the existing goto-clean idiom in queue_ctrl).

bug-1396 (job-count anomaly after cold-restart-all, not yet root-caused):
instrumented test-commit-durability.sh's assert_job_count() to dump the live
joblist and ACKED_FILE ledger on any count mismatch instead of only the
count, per the bug's own recorded next step.

Verified: controller ASAN build + full controller_unit_test green; lib
xcelib_test 285/285 green, 0 ASAN leaks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SDWVNQLKxqTVHh42cH7rV3

src/tools/test-commit-durability.sh

@@ -392,7 +392,15 @@ assert_job_count() {
         pass "$label: cluster lists exactly $expected jobs"
         return 0
     else
-        fail "$label: job count != $expected after recovery (see expect-jobs output above)"
+        # bug-1396: a bare count mismatch isn't enough to diagnose an extra-job
+        # anomaly — dump the live joblist and the harness's own ACKED_FILE
+        # ledger side by side so the diverging job ID is visible in the log
+        # instead of only the count.
+        yellow "  $label: job count mismatch — dumping live joblist vs ACKED_FILE for diagnosis"
+        xce_test_script "$(printf 'set masters %s\nclient\njoblist\n' "$MASTERS")"
+        echo "  --- ACKED_FILE (tracked committed jobs, deduplicated) ---"
+        sort -u "$ACKED_FILE" | sed 's/^/    /'
+        fail "$label: job count != $expected after recovery (see joblist/ACKED_FILE dump above)"
         return 1
     fi
 }