Guard Free against invalid devices

[fallintoplace]

Summary

• only return devices to the allocator when they are currently allocated by that allocator
• ignore nil, unknown, unallocated, or fabricated devices instead of adding them to the available set
• add focused tests for normal frees and invalid device inputs

Why

Free previously inserted every provided device into remaining before deleting it from allocated. That allowed a foreign or constructed Device to become available for future allocations.

Testing

• go test ./...