[BUG] UpstreamCheckService.fetchUpstreamData stores a LinkedList in UPSTREAM_MAP, but submitJust assumes CopyOnWriteArrayList (CME risk)

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/UpstreamCheckService.java:468-496` vs `:213-235`
- description: `fetchUpstreamData` creates `List commonUpstreams = new LinkedList<>()` and `UPSTREAM_MAP.put(selectorDO.getId(), commonUpstreams)`. Later, `submitJust` does `MapUtils.computeIfAbsent(UPSTREAM_MAP, selectorId, k -> new CopyOnWriteArrayList<>())` — since the key already exists, it returns the **LinkedList**, then mutates it with `add`/`removeIf`. Meanwhile the scheduled `check` thread iterates the same list. LinkedList is not thread-safe and its iterator is fail-fast → CME.
- impact: Registration/check races can throw CME inside the scheduler (silently swallowed) or lose upstream entries.
- suggested_fix: Always store `CopyOnWriteArrayList` in `UPSTREAM_MAP`; have `fetchUpstreamData` build a `CopyOnWriteArrayList`.
- confidence: Medium
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/UpstreamCheckService.java, comparing fetchUpstreamData at lines 468-496 with submitJust at lines 213-235 and the scheduled check path. Verify that UPSTREAM_MAP consistently contains CopyOnWriteArrayList instances and that concurrent registration and checking no longer risks a ConcurrentModificationException or lost upstream entries.

Written by the indexing model from the issue text.