usbh: completed transfer frees the endpoint before xfer_cb consumes the buffer

Follow-up from #3937 (#1292 device-side fix).

usbh.c clears BUSY|CLAIMED on transfer completion (around line 810) before the class driver's xfer_cb runs, the same shape as the device-side #1292 race. A task that claims and re-arms the endpoint in that window could overwrite a buffer the driver has not consumed yet.

Evidence: source inspection only. No host-side reproduction yet. The device fix (#3937) adds TU_EDPT_STATE_RX_PENDING; tu_edpt_claim already refuses it, but usbh never sets it, so host behaviour is unchanged.

Remaining work:

• identify host class drivers that re-arm OUT/IN endpoints from application context (cdc_host, midi_host, midi2_host stream reads)
• decide whether usbh should publish RX_PENDING on completion, as usbd now does
• add a reproducer (a reader task at higher priority than the host task), then validate on hardware

Deferred because it is a separate module with its own drivers and test rig, and the device fix was kept minimal.