UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callback

Summary: The CVE-2026-9080 fix re-fetches the sh_entry after the socket callback inside `mev_sh_entry_update()`, because `curl_easy_pause()` called from that callback re-enters `mev_assess()` and can free the entry. The same re-fetch was not applied at the caller, `mev_pollset_diff()`, which …

mresult = mev_sh_entry_update(multi, data, entry, s,
                              prev_ps->actions[i], 0);
if(mresult)
  return mresult;
/* the callback may have freed this entry via curl_easy_pause(); re-fetch */
entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
if(entry)
  CURL_TRC_M(data, "ev …