Fix panic-safety of eleven methods, and Deque's ring buffer indexing

[tooson9010-spec]

Fixes the panic-safety issues from #8. While writing the tests I hit a
separate Deque bug that isn't in that issue — it's fixed here too, see
below.

Deque addresses the ring buffer without the front offset

Deque::truncate and retain compute physical slots as i % capacity,
but everywhere else in the type logical indices go through
physical_index, which is (front + i) % capacity. One push_front
makes front non-zero, and from then on both methods walk the wrong
slots — destroying memory that was never initialized, handing it to the
user's predicate as a &T, and leaving live elements alone. No panic
involved.

retain_respects_front builds a deque holding [10, 20, 30] and records
what the predicate sees; before the fix that's [20, 30, <garbage>].
truncate_respects_front ends the test process with SIGSEGV.

Panic-safety

Nine of the reported methods destroy values and only afterwards commit the
metadata that removes them from the collection. For ListMap and
PackedPool that's worse than a stale length, since their Drop impls
call clear and re-enter the loop they just unwound out of.

Vec::truncate, Deque::truncate, ListMap::clear, PackedPool::clear
and UnitCache::clear now commit first. Where the values are contiguous
they're dropped as a slice, so a panicking destructor doesn't leak the
ones behind it. PackedPool recycles its slots in a separate pass
beforehand — that part can't panic.

ListMap::remove and LruCache2::get_or_insert_with instead read the
value out of the slot before running anything user-controlled, which ends
the collection's claim on it right away.

DirectPool::try_insert_with_handle needed the opposite: it marked the
slot occupied before calling the closure that fills it, so it now runs the
closure first. Its test segfaults without the fix.

Deque::retain is the one case the predicate alone can break — ptr::copy
leaves the source valid, so a compacted element briefly lives in two slots
that are both inside the current length. It now keeps its progress in a
drop guard that compacts the unvisited tail back in on unwind.

Tests

Eleven, all in the existing mod tests blocks except cache.rs and
list_map.rs, which had none. Each was run against the unpatched code
first and fails there — inflated drop count, wrong value reaching user
code, or SIGSEGV.

test_utils::Droppable gets an opt-in panic_on_drop that disarms itself
before unwinding, so a double drop shows up as a count rather than an
abort. std comes in under cfg(test) for catch_unwind. 223 doc-tests
and the existing unit tests still pass.