handover_fsm: fix send_handover_performed() using wrong lchan
send_handover_performed() is called from handover_end() before gscon_change_primary_lchan() updates conn->lchan to the new lchan. As a result, the Cell Identifier, Chosen Channel, Chosen Encryption Algorithm, and Speech Version/Codec IEs were all populated from the source (old) lchan rather than the target (new) lchan.
As per 3GPP TS 48.008 §3.2.1.25, HANDOVER PERFORMED must report the target cell and channel. For intra-BSC handover to a different BTS this caused the MSC to receive the wrong Cell Identifier.
Fix by initialising lchan from ho->new_lchan instead of conn->lchan, and deriving the BTS via lchan->ts->trx->bts.
Change-Id: I4111351dc38fc2dbe844c2bd07b3ecfaaadd864e Related: osmo-ttcn3-hacks.git I82aadcc3a80c183cb93522b829071294b156a218 Found-By: Claude Sonnet 4.6
