fix(core,kernel): subscription-path + buildQuery correctness fixes

[EnriqueParodi]

Three crashes/dangling-pointer bugs in the subscription + query path, plus a
handful of tightening fixes found while auditing the path.

Backend correctness:

• SEGV in NativeObjectProxy::senImplEventEmitted on subscribeAll churn:
  a subscriber being added while another was being removed could see a
  half-initialised slot. Iteration now snapshots-and-walks; mutation goes
  through a deferred queue. Regression test in test_kernel.
• ObjectFilter::addSubscriber no longer carries a two-step "subscribe,
  then seedFromExistingObjects" handshake; the combined seedFromExisting
  call is the single API. Half-initialised state is no longer reachable.
• buildQuery drops the cached raw ClassType*. The cache was the source
  of one of the SEGV stacks (stale pointer after a type was unregistered);
  inlining the lookup is cheaper than the cache it replaced.
• Half-empty bus addresses (s. or .b) used to be permissive-skipped
  in selectFrom; now they fail loud at config-validation time.

Documentation:

• selectAllFrom / selectFrom now document the callback-lifetime contract
  (callbacks may fire after the caller's lifetime; capture state through
  a shared_ptr that the callback owns). Pre-existing core convention,
  newly written down.
• EventBuffer's invalidate-before-erase comment now matches its actual
  failure mode (was misnamed).
• Renamed Event*-flavored proxy state to Property* where it was tracking
  property changes, not events.

Testing:

• Added three regression tests covering the SEGV, the addSubscriber
  seed race, and half-empty-bus-address rejection.

This branch is the chain's foundation: every downstream branch (libs/gen,
jsonrpc, web-explorer) is sensitive to kernel subscription correctness.
The fixes here are root-cause; nothing downstream needs a workaround.