db/kv/membatchwithdb: synchronize MemoryMutation.UnderlyingTx

## Problem

`MemoryMutation` documents its backing transaction as protected by `mu`. `UpdateTxn` and `DetachDB` write `m.db` under the write lock, and `Pin` reads it under the read lock, but `UnderlyingTx` returns `m.db` without locking.

A caller that unwraps an overlay while another goroutine updates or detaches its backing transaction therefore has a data race and may observe an inconsistent transaction lifetime. The accessor is already unsafe on `main`; cache-generation unwrapping and other future consumers make the contract easier to misuse.

## Proposed direction

Read `m.db` under `m.mu.RLock`, matching `Pin`. Audit other direct backing-transaction reads and keep cursor operations under their existing single-threaded ownership rule rather than broadening this change unnecessarily.

## Acceptance criteria

- Add a race-detector regression test that reads `UnderlyingTx` while the backing transaction is updated.
- Synchronize the accessor without changing transaction ownership.
- Verify overlay read-view and detach behavior remains unchanged.
- Run `db/kv/membatchwithdb` tests under the race detector.