MEM-040: graf — verb error paths leak the 18 MB owned graf open (be head / be map) and two init mmaps

Several graf verbs that open their own graf context (own_open=true, ~18 MB of mmaps: 16 MB GRAF_ARENA + 2×1 MB obj bufs, plus keeper/kv) leak it whenever a post-open call() early-returns. be head ?<branch> (LOG.c:978 graf_head_ahead_behind) and be map: (MAP.c:229 GRAFMap) both own-open then hit fallible GRAFSwitchBranch/other calls that return without GRAFClose. Plus two partial-acquisition mmap leaks: WEAVEDecInit (GET.c:568) leaks 1-6 of its 7 regions on a mid-init map failure, and DAGAncestorsTunable (DAG.c:237) leaks the queue anonymous mmap when the immediately-following a_carve fails. All are reachable real error paths, not OOM-only. From the MEM sweep.

Issues

Owned graf opens and partial inits are not released on post-acquisition error returns.

LOG.c:978 graf_head_ahead_behind: be head ?<branch> (graf not already open) leaks the 18 MB own-open on a post-open call() error.
MAP.c:229 GRAFMap: be map: leaks the 18 MB own-open on GRAFSwitchBranch / later call() failures.
GET.c:568 WEAVEDecInit: a mid-init mmap failure leaks the regions already mapped (1-6 of 7).
DAG.c:237 DAGAncestorsTunable: call(wh128bMap, queue, cap) succeeds, the next a_carve fails, the queue mmap leaks.

Blockers

None; graf-internal. The own-open cases need a GRAFClose on every post-own-open error path; the partial-init cases need rollback of already-mapped regions.

Planned

Close the owned graf and roll back partial inits on every error path.

Repro first (CLAUDE §17): force a post-open failure in be head / be map and assert no mmap leak (ASAN / fd+map count stable).
Wrap the own-open verbs so own_open=true GRAFClose runs on every error exit (goto-cleanup or a try-close idiom).
WEAVEDecInit: unmap any region already mapped before returning the init error; DAGAncestors: unmap queue on the carve-failure branch.