Move `item->event` assignment after the payload allocation check in
`sentry__envelope_add_event` and `sentry__envelope_add_transaction`.
Previously, if `sentry__jsonwriter_into_string` failed, the event was
already owned by the envelope item. Multiple callers decref the event
and free the envelope on failure, leading to a double-decref because
`sentry_envelope_free` also decrefs `item->event` via item cleanup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>