Hand the generated loop's own Maps on at the run's last use

[jasisz]

__bump (run.versions) and __park (moved.slots) copied their Map on every answer on the VM. Each one read the run whole inside the same record update that sets the Map: __versionOf(run, owner) in __bump, and moved.now / __versionOf(moved, owner) in __park. That meant the #1429 field take could never apply.

What changes (generated Aver only)

• __bump and __park. Both bind the version (and in __park the clock) first, then update the run at its last use. The Map field is read once, inside the update that replaces it.
• __take<Module>. It now returns (run.<field>, __Run.update(run, <field> = Option.None)): the state is read first and the run is updated at its last use. The update then moves the run's other fields instead of leaving the dead run holding slots and versions. The tuple order flips, and __serve<P> matches (__held, __rest).
• __seatFamily<P>. Same class of problem, found by the warning: it passed kept.retired<P> and Map.keys(kept.retired<P>) to one call. It now lists the keys first.

perf-shared-update on the generated functions

The warning skips __ functions, so I checked with that filter lifted locally (the change is not committed). I ran aver check on run_all_slice, run_owned_answer_state, run_schedule_cases and run_families:

• main: reports __bump, __park and __seatFamilyMember.
• this branch: reports nothing in any generated function.

Measurements

Map writes the runtime refused because something else held the Map, from aver run --profile, release build without LTO:

	main	this PR alone	#1436 alone	#1436 + this PR
run_owned_answer_state	802	802	403	4
same, 2000 requests / 100k-entry state	8002	8002	4003	4

On its own this PR does not change the VM numbers. The run reaches __serve<P><Kind> through the __take tuple, and on main that tuple still holds the run (#1436 fixes that). With #1436 in, the per-answer copies of the loop's own Maps go away. These Maps are small, so wall time does not move (0.125 s vs 0.126 s at 2000 requests).

Tests

• run_all_spec: the dump test now pins the three new shapes. rust_work_spec pins let (__held, __rest) = __takeOwner(run);, and the Rust side still hands the state over by value.
• Passing locally: run_all_spec, rust_work_spec, yield_verify_spec (including the Lean check of the coordinator laws: __park law anErrKeepsTheInstance stays universal), and wasm_work_spec --features wasm.
• python3 tools/regenerate_self_host.py --check: the self-host does not change. cargo fmt is clean.