answer the Gx RAA before the work it implies

[next-nf]

Completes rollout step 5. Architecture §3: a reentrant provoked request is serviced
immediately — "the protocol answer (RAA, PFCP report response) goes out at once. Any
larger bearer procedure the reentrant request implies is queued behind the running
procedure."

The Gx RAR clause was one synchronous block — validate → PFCP modify → Gy charging →
PFCP modify → then aaa_reply. While a procedure was parked the gate postponed the
whole RAR, so the RAA was delayed by the parked procedure's duration. Not a spec
violation, but the RAA is the PCRF's flow control: per TS 29.212 §4.5.2.0 it "should not
send a new RAR to the PCEF for the same IP-CAN session until the previous RAR has been
acknowledged", so an unacknowledged RAR stalls that session's policy pipeline.
DIAMETER_PENDING_TRANSACTION does not apply — TS 29.213 §8.2 binds only when both peers
advertised the PendingTransaction feature, which next-nf neither implements nor negotiates.

Where the split falls

TS 29.212 §4.5.12 splits failure reporting by stage, and on the PUSH path that maps exactly
onto the existing code:

Failure stage	Reported in	Code
validation	RAA	PCCErrors2 from gx_events_to_pcc_ctx(…, install, …) — pure rulebase validation, no external I/O
resource allocation	new CCR	PCCErrors4 from gy_events_to_pcc_ctx/3 — rules left without granted credit

So answering early is not merely permitted: it moves PCCErrors4 from the RAA (where it
rides today) to the CCR where §4.5.12 wants it.

What's here

• The inline half validates, sends the RAA with the validation-stage report, commits the
  validated PCC2, and emits {next_event, internal, {gx_rar_apply, PCC0, PCC1, PCC2}}.
• A new gated {gx_rar_apply, …} clause carries the PFCP/Gy work verbatim — this change
  moves that code, it does not rewrite it. Converting its two blocking modify_session
  calls to async_m remains part of the separate "~11 blocking sites" work.
• Allocation-stage failures now go out as a fire-and-forget CCR-U, reusing the pattern
  already used on the establishment path in smf_gtp_gsn_lib.erl:160-166.
• The gate clause narrows from {_, 'RAR'} to {gy, 'RAR'}. Gy still queues whole: it
  already answers early, but runs triggered_charging_event/4 inline, which touches the
  shared PCtx. The Gy and unknown-session clauses needed no other change — Gy was already
  the template this follows.

Ordering with multiple RARs

Committing PCC2 before answering is what makes concurrent RARs safe without any new state.
Two RARs can only overlap while a procedure is parked; in that window RAR #2 validates on top
of the PCC2 RAR #1 already committed, so the postponed applies run FIFO and the last writes
a PCC4 derived from the newest PCC2. Intermediate applies push superseded rule sets and
are overwritten — extra modify_session calls, converging on the same result the fully
serialized code reaches today. No rar_apply_pending flag, no extra gate clause, no new State
field.

Testing

gx_rar_answers_raa_while_parked parks a procedure with the UPF held, injects a Gx RAR, and
asserts the RAA comes back while still parked and that async_pending is still 1. Verified
red first with raa_not_answered_while_parked.

The ten existing gx_rar* cases are the regression net for the restructure. gx_rar asserts
pcc_rules immediately after the RAA, which still holds because PCC2 is committed before
answering. gx_invalid_charging_rule / gx_invalid_charging_rulebase count
smf_aaa_pcf:ccr_update calls and assert exactly 1 — checked rather than assumed, and the new
CCR-U does not perturb them.

pgw_SUITE 137/137; ggsn_SUITE + saegw_s11_SUITE 100, 0 failures.

Stacked on #61. Merge bottom-up: #45 → #46 → #48 → #56 → #57 → #58 → #59 → #61 → this.