fix: use self_alloc provenance for parent pointers in cursor

Author: avrabe

src/cursor.rs

@@ -260,7 +260,13 @@ impl NodeData {
         let res = NodeData {
             _c: Count::new(),
             rc: Cell::new(1),
-            parent: Cell::new(parent.as_ref().map(|it| it.ptr())),
+            parent: Cell::new(parent.as_ref().map(|it| {
+                // Use parent's self_alloc pointer which retains full allocation provenance
+                // from Box::into_raw. Using it.ptr() would give a pointer derived through
+                // &NodeData references, whose provenance gets frozen under tree borrows,
+                // causing UB when free() later deallocates through the parent chain.
+                unsafe { ptr::NonNull::new_unchecked((*it.ptr().as_ptr()).self_alloc) }
+            })),
             index: Cell::new(index),
             green,