Rollup merge of #161975 - matthew-demidoff:btree-split-off-panic-safety, r=nia-e

Abort instead of unwinding out of an inconsistent BTreeMap::split_off

Fixes rust-lang/rust#158165. Supersedes rust-lang/rust#161784, which I had to abandon after a bad force-push from a shallow clone left its head detached.

`BTreeMap::split_off` runs the caller's `Ord`/`Borrow` impl via `search_node` inside `Root::split_off`'s descent. After the first `move_suffix`, the two roots alias the same values through structurally invalid trees until the borders are fixed; a comparator panic there unwinds with a stale length and double-frees on later iteration or drop. It is reachable from `#![forbid(unsafe_code)]` on stable (reproducer on the issue).

Guard the descent loop with an abort-on-panic `PanicGuard`, as `btree::mem::replace` already does. `catch_unwind` isnt available in `alloc` (no_std), and I kept an inline guard rather than the unstable `DropGuard`. It is armed once before the loop; the first `search_node` stays outside it, since a panic there can still unwind safely (nothing has moved yet).

Verified with Miri: the reproducer goes from a double-free to a clean abort, and normal multi-level splits are unaffected. Adds a happy-path regression test.

Credit to @ostrowr for the report and to rust-lang/rust#158710 for the original approach.

r? @nia-e