Mellow Flexible Vaults: Targeted-lockup bypass: freshly minted shares can be transferred immediately in the same `transfer()` or `transferFrom()` call

Mellow's TokenizedShareManager applies a per-account targeted lockup to newly minted shares, but the ordering of operations inside the ERC-20 _update hook lets users defeat it. Because claimShares(from) runs after the lock check yet before the actual transfer, …