Support caller-owned HAMT control storage

[helly25]

Let HAMT users place the reference-counted allocation-domain control block in caller-owned bounded storage. This closes a separate hidden allocation path while preserving shared snapshot lifetime and cleanup semantics.

AG;DR

• add HamtSourceDomain::TryCreateIn(control_source, node_source_args...);
• store the borrowed control source and a type-erased non-throwing release callback in the control block;
• destroy the node source before returning the control block to its original allocator when the final snapshot is released;
• report control-storage exhaustion as std::nullopt before constructing the node source;
• preserve the ordinary TryCreate API by routing it through NewDeleteBlockSource;
• document that caller-owned control storage must outlive every retained domain handle;
• test last-snapshot release and exhausted-control failure without node-source construction.

Validation:

• bazel test //mbo/container:hamt_source_domain_test
• focused pre-commit hooks on all changed files, with local clang-tidy intentionally left to CI