Add ready queue dequeue path in mo_task_cancel()

Previously, mo_task_cancel() only removed the task node from the global
task list (kcb->tasks) but did not remove it from the ready queue.
As a result, the scheduler could still select a canceled task that
remained in the ready queue.

Additionally, freeing the node twice could occur because the same node
was already freed after list_remove(), leading to a double-free issue.

This change adds a call to sched_dequeue_task() to remove the task from
the ready queue, ensuring that once a task is canceled, it will no longer
appear in the scheduler’s selection path. This also prevents memory
corruption caused by double-freeing list nodes.

Author: vicLin8712

kernel/task.c

@@ -721,12 +721,17 @@ int32_t mo_task_cancel(uint16_t id)
         }
     }
 
+    /* Remove from ready queue */
+    if (tcb->state == TASK_READY) {
+        list_node_t *rq_node = sched_dequeue_task(tcb);
+        free(rq_node);
+    }
+
     CRITICAL_LEAVE();
 
     /* Free memory outside critical section */
     free(tcb->stack);
     free(tcb);
-    free(node);
     return ERR_OK;
 }