fix UAF: dupe FrameWork.hostname per submit instead of borrowing master
FrameWork.hostname was a borrowed slice from sub.options.hostname, documented as "stable lifetime". it isn't: slurper.runWorker frees sub.options.hostname after sub.run() returns, but FrameWorks for that subscriber may still be queued in the frame pool. once the allocator reuses that memory, pool workers read garbage when logging chain breaks, host authority decisions, etc. repro: zlay-reconnect cronjob spawns ~1839 hosts in 134s. some subscribers churn within that window. corrupted hostnames appear in logs as DIDs (the freed slot got reused for a DID dup) or with stack-pointer-shaped bytes overlaying the suffix. fix: dupe hostname alongside data when submitting to the pool, free both in processFrame. one extra alloc/free per frame.