btrfs: stripe_alloc: saturate the read-only guard's claimable subtraction

btrfs: stripe_alloc: saturate the read-only guard's claimable subtraction

The guard that keeps admitted bytes placeable when a group goes read-only
subtracts the group's claimable bytes from the space_info's total.  The
two are not an atomic snapshot: stripe_claimable_mod() adds a delta to
bg->stripe_claimable under the free-space tree lock and takes
sinfo->lock only afterwards to add it to the aggregate, and
inc_block_group_ro() holds sinfo->lock and the group's lock but not the
tree lock, so it can read a group value that is ahead of the total.  The
unsigned subtraction then wraps to a huge supply, the guard admits the
transition, and the group's stripes leave the supply under writers the
gate already admitted -- the writeback allocation failure and data loss
the guard exists to prevent.

Saturate the subtraction.  Found by review (2026-09-15), not by a test;
the window is a few instructions wide, and the fill-edge and reclaim
tests would report it only as a rare unexplained drop.

Assisted-by: Claude:claude-fable-5-1