v1.0.7

fix: flush workqueue BEFORE fsnotify_destroy_group to close race window

The previous fix (v1.0.6) placed flush_workqueue(system_unbound_wq)
AFTER fsnotify_destroy_group(g).  This was wrong because
fsnotify_destroy_group internally calls fsnotify_put_group which frees
the group struct.  The kworker running fsnotify_mark_destroy_workfn
could execute between the group being freed and our flush, dereferencing
mark->group->ops on SLUB-poisoned memory (fault addr 0xfffffffffffffffc).

Moving the flush BEFORE fsnotify_destroy_group ensures the async mark
destruction workfn completes while the group is still alive, then
fsnotify_destroy_group can safely free it with no pending work remaining.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>