Keep the created and destroyed callbacks symmetric

call_status stopped at the first failing callback, but the load-failure
path then called vm_callback_destroyed, which runs the whole destroyed
list. With two extensions registered in the order [B, A]: B's created
succeeds and allocates per-VM state, A's created blocks the load, and A
then gets a destroyed for a context it never saw -- freeing or
decrementing state it never took. When the first created fails, nobody
was created and everybody is destroyed.

The two lists are registered independently, so an index in one does not
correspond to an index in the other and the driver cannot deliver
destroyed to just the prefix that ran. Run every created callback
instead, latching the first failure as the result. Every callback then
observes every context and the destroyed list stays a valid pairing.

Precall/postcall already behave correctly: precall short-circuits, and
postcall is skipped entirely when it does.