ao_coreaudio: register hotplug listener after init succeeds

ao_uninit() calls the driver's uninit() only once ao->driver_initialized
is set, i.e. after init() has succeeded, but it frees the ao either way.
init() registered the hotplug listener before the steps that can fail, so
a failed init left CoreAudio holding two property listeners whose
clientData pointed at freed memory. mpv falls back to the next ao driver,
so the process stays alive and the next device change enters hotplug_cb()
on the freed ao.

Easy to hit on macOS 26/27, where init_audiounit() fails with -50 for some
channel layouts and mpv falls back to ao_avfoundation. Under ASan this is
a heap-use-after-free in hotplug_cb() with the free attributed to
ao_uninit(); without it the crash depends on what reuses the block, since
mp_msg_level() dereferences log unconditionally.

Register after everything that can fail instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: SeanLF

audio/out/ao_coreaudio.c

@@ -167,9 +167,6 @@ static int init(struct ao *ao)
     if (!reinit_device(ao))
         goto coreaudio_error;
 
-    if (!register_hotplug_cb(ao))
-        goto coreaudio_error;
-
     if (p->change_physical_format)
         init_physical_format(ao);
 
@@ -193,6 +190,11 @@ static int init(struct ao *ao)
     p->queue = dispatch_queue_create("io.mpv.coreaudio_stop_during_idle",
                                      DISPATCH_QUEUE_SERIAL);
 
+    // Register last: ao_uninit() does not call uninit() for a failed init, but
+    // frees the ao, so a listener registered earlier would outlive it.
+    if (!register_hotplug_cb(ao))
+        goto coreaudio_error;
+
     return CONTROL_OK;
 
 coreaudio_error: