fix: heap-paranoia false-positive from free-before-publish ordering

tplAddFunc (template.zig) and mapSet (vm_map.zig) freed the old
managed slice before repointing the object's field to the new one,
so heap-paranoia's live-object scan caught the object still
referencing the bytes being freed. Publish first, then free, matching
the pattern already established in mapInsertHashed/vm.zig/template.zig
elsewhere in this file.

Author: ganehag

src/lang/native/template.zig

@@ -791,8 +791,10 @@ pub fn tplAddFunc(ctx: VMContext, tmpl_obj: *Object, name: []const u8, func_val:
             const m_now = funcs_obj.map_managed;
             @memcpy(new_items[0..old_len], m_now[0..old_len]);
             new_items[old_len] = .{ .key = .{ .string = try ctx.cs.internStr(name) }, .value = func_val };
-            ctx.hs.freeManagedSlice(MapEntry, m_now);
+            // Publish before freeing the old slice so paranoia doesn't see a
+            // live object (funcs_obj) still pointing at the bytes being freed.
             funcs_obj.* = .{ .map_managed = new_items[0 .. old_len + 1] };
+            ctx.hs.freeManagedSlice(MapEntry, m_now);
         },
         else => return error.TypeError,
     }

src/lang/vm_map.zig

@@ -168,8 +168,11 @@ pub fn mapSet(ctx: VMContext, container: Value, key: Value, val: Value) !void {
     const items_now = try vms.asMapSlice(container.object);
     @memcpy(ext[0..old_len], items_now);
     ext[old_len] = .{ .key = key, .value = val };
-    if (container.object.* == .map_managed) ctx.hs.freeManagedSlice(MapEntry, container.object.map_managed);
+    // Publish before freeing the old slice so paranoia doesn't see a live
+    // object (container.object) still pointing at the bytes being freed.
+    const old_to_free: ?[]MapEntry = if (container.object.* == .map_managed) container.object.map_managed else null;
     container.object.* = .{ .map_managed = ext[0..new_len] };
+    if (old_to_free) |old| ctx.hs.freeManagedSlice(MapEntry, old);
     if (new_len > 8) {
         const bcount = mapBucketsForCount(new_len);
         const buckets = try vmgc.vmAllocManagedSlice(ctx, i32, bcount);