queue: make sure link is NULL before enqueue

It was lazy to not set ucontext_t::uc_link to NULL before adding it to a
context::queue.  A future commit to intrusive_queue will assert that this is
the case.
intrusive: assert + set NULL link

It was lazy not to assert that T::*link is NULL when adding an object to an
intrusive structure and lazy not to set T::*link to NULL when removing an
object from an intrusive structure.

Originally, it seemed like any ucontext would transfer to context::uc_link
on termination even if uc_link was modified after makecontext.  It turns out
that this is not the case, so the scheduler must setcontext at the end of
the trampoline anyway and uc_link is meaningless except to the code that
reclaims context objects.

intrusive_stack just came along for intrusive_queue's misguided ride.
killer: assert that mark is unlinked in destructor

This is a follow-up to the recent intrusive_stack changes that clear
T::*link.  A killer's mark now asserts that it is not part of a hitlist,
i.e.  that the link is NULL, upon destruction.