Temporary sub-instances are not recognized as part of the "sub" group

[bemson]

This issue occurs (at least) when a branch denies the "sub" access group, but the sub-instance can still successively manipulate it's capturing instance.

The access group "sub" applies to flows which are in the permanent and buffered capture bins. However, the logic only acknowledges sub-instances in the permanent bin. Line 1725 demonstrates how only permanent subs are inspected. The temporary bin is pkg.tin (not pkg.bin).

The result allows for false-positives when checking for the "world" group. World can only be true when "sub" fails.

[bemson]

The following code doesn't fail currently, but stepping through the execution reveals the problem (i.e., "world" is incorrectly resolved as true, because "sub" does not resolve correctly).

var flow = new Flow({
  minions: {
    _capture: true,
    _perms: '!sub',
    _in: function () {
      new Flow(function () {
        if (!flow.go('//revolt')) {
          console.log('I must obey!');
        }
      });
      this.subs()[0].go(1);
    },
    revolt: function () {
      console.log('Et tu, Brute?');
    }
  }
});
flow.go('//minions');
// I must obey!