net/rpc timeout race: a local reply var only helps if untouched

Follow-up to the 'never read the reply after a net/rpc timeout' pattern. Fanning out calls into results[i] by passing &results[i] as the reply races on timeout, because the abandoned call may still be decoding into it while you overwrite it with an error value. The usual fix is to decode into a goroutine-local var and copy it over only on success. But writing r = ErrReply{...} into that same local on error is still the race, just moved. On error, put the error value straight into results[i] and never touch the local again. Audit every caller of the timeout wrapper: a var r Reply; err = call(&r); out = r.Field line that reads r unconditionally has the same bug.