Aliasing violations in splice, mutable iteration and cursors

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models CWE-758. All four are reachable from safe code with standard Ord types. 1. Splice back-pointer...