Fix second use-after-free in the rollback path; clang battery re-validated

ASan with halt_on_error caught a second dangling read on the exact path
--rollback-fsck-changes exits through: fsck_rollback() called freemem(fs)
at fsck/main.c:1313 and then printed the closing banner via
fsck_progress(...), which dereferences fs (fsck_data(fs) etc.).

Print the banner before the cleanup, matching the order the_end() and the
rebuild paths already use. No behavior change otherwise -- the same bytes
are emitted, only before the free.

Re-validated after the fix:
- clang+ASan/UBSan with halt_on_error: rollback save/restore, garbage-magic
  rejection, resize 64->128 MiB, mkfs, check, tune, debugreiserfs -- zero
  sanitizer errors; restore still prints "blocks restored" and the final
  banner.
- host functional battery (gcc, --enable-warnings): 12/12.
- host clang out-of-tree build: 0 warnings; clang rollback path exercised
  without sanitizers: exit semantics unchanged.
- Debian VM, CC=clang battery on this exact tree: 12/12, 0 warnings.

tests/vm/RESULTS.md documents the finding (item 6 in the clang section).

fsck/main.c

@@ -1303,16 +1303,19 @@ static void fsck_rollback(reiserfs_filsys_t fs)
 			 fsck_progress_file(fs));
 	close_rollback_file();
 
+	/* print the closing banner while fs is still valid: freemem(fs)
+	   below releases it.  Same order as the_end() and the rebuild
+	   paths (ASan caught the opposite order here). */
+	time(&t);
+	fsck_progress("###########\n"
+		      "reiserfsck finished at %s" "###########\n", ctime(&t));
+
 	close(fs->fs_journal_dev);
 	free(fs->fs_file_name);
 	fs->fs_file_name = NULL;
 	close(fs->fs_dev);
 	freemem(fs);
 
-	time(&t);
-	fsck_progress("###########\n"
-		      "reiserfsck finished at %s" "###########\n", ctime(&t));
-
 	exit(EXIT_FIXED);
 }