SNP spawn failure leaks an attached phantom thread and can block process quiescence

One bug found by [Specula](https://github.com/specula-org/Specula):

do_clone attaches the child thread and increments nr_threads before calling the platform spawn path. The SNP platform then moves ThreadStartArgs through Box::into_raw; if the host clone3 call fails, result? returns without reconstructing/dropping that box, so the child ThreadState never detaches. The leaked phantom thread is visible through sys_sysinfo().procs and can block process quiescence through wait_for_exit / exec thread-kill waiting.

See the [report](https://github.com/specula-org/specula-case-studies/blob/data/litebox-case-study-20260831/systems/litebox/modules/core/runs/litebox-known-aware-rerun-20260830/confirmed-bugs.md#entry-7-snp-spawn-failure-leaks-an-attached-phantom-thread-and-can-block-process-quiescence) for more details.