Phase 12: Shared SuperSlab Pool implementation (WIP - runtime crash)

## Summary
Implemented Phase 12 Shared SuperSlab Pool (mimalloc-style) to address
SuperSlab allocation churn (877 SuperSlabs → 100-200 target).

## Implementation (ChatGPT + Claude)
1. **Metadata changes** (superslab_types.h):
   - Added class_idx to TinySlabMeta (per-slab dynamic class)
   - Removed size_class from SuperSlab (no longer per-SuperSlab)
   - Changed owner_tid (16-bit) → owner_tid_low (8-bit)

2. **Shared Pool** (hakmem_shared_pool.{h,c}):
   - Global pool shared by all size classes
   - shared_pool_acquire_slab() - Get free slab for class_idx
   - shared_pool_release_slab() - Return slab when empty
   - Per-class hints for fast path optimization

3. **Integration** (23 files modified):
   - Updated all ss->size_class → meta->class_idx
   - Updated all meta->owner_tid → meta->owner_tid_low
   - superslab_refill() now uses shared pool
   - Free path releases empty slabs back to pool

4. **Build system** (Makefile):
   - Added hakmem_shared_pool.o to OBJS_BASE and TINY_BENCH_OBJS_BASE

## Status: ⚠️ Build OK, Runtime CRASH

**Build**: ✅ SUCCESS
- All 23 files compile without errors
- Only warnings: superslab_allocate type mismatch (legacy code)

**Runtime**: ❌ SEGFAULT
- Crash location: sll_refill_small_from_ss()
- Exit code: 139 (SIGSEGV)
- Test case: ./bench_random_mixed_hakmem 1000 256 42

## Known Issues
1. **SEGFAULT in refill path** - Likely shared_pool_acquire_slab() issue
2. **Legacy superslab_allocate()** still exists (type mismatch warning)
3. **Remaining TODOs** from design doc:
   - SuperSlab physical layout integration
   - slab_handle.h cleanup
   - Remove old per-class head implementation

## Next Steps
1. Debug SEGFAULT (gdb backtrace shows sll_refill_small_from_ss)
2. Fix shared_pool_acquire_slab() or superslab_init_slab()
3. Basic functionality test (1K → 100K iterations)
4. Measure SuperSlab count reduction (877 → 100-200)
5. Performance benchmark (+650-860% expected)

## Files Changed (25 files)
core/box/free_local_box.c
core/box/free_remote_box.c
core/box/front_gate_classifier.c
core/hakmem_super_registry.c
core/hakmem_tiny.c
core/hakmem_tiny_bg_spill.c
core/hakmem_tiny_free.inc
core/hakmem_tiny_lifecycle.inc
core/hakmem_tiny_magazine.c
core/hakmem_tiny_query.c
core/hakmem_tiny_refill.inc.h
core/hakmem_tiny_superslab.c
core/hakmem_tiny_superslab.h
core/hakmem_tiny_tls_ops.h
core/slab_handle.h
core/superslab/superslab_inline.h
core/superslab/superslab_types.h
core/tiny_debug.h
core/tiny_free_fast.inc.h
core/tiny_free_magazine.inc.h
core/tiny_remote.c
core/tiny_superslab_alloc.inc.h
core/tiny_superslab_free.inc.h
Makefile

## New Files (3 files)
PHASE12_SHARED_SUPERSLAB_POOL_DESIGN.md
core/hakmem_shared_pool.c
core/hakmem_shared_pool.h

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: ChatGPT <chatgpt@openai.com>

core/tiny_free_fast.inc.h

@@ -59,12 +59,9 @@ extern void tiny_alloc_fast_push(int class_idx, void* ptr);
 // Invariant: This check MUST be atomic (no TOCTOU between check and push)
 static inline int tiny_free_is_same_thread_ss(SuperSlab* ss, int slab_idx, uint32_t my_tid) {
     TinySlabMeta* meta = &ss->slabs[slab_idx];
-
-    // Box 3 (Ownership): Load owner_tid atomically
-    uint32_t owner = tiny_atomic_load_u32_relaxed(&meta->owner_tid);
-
-    // Same thread check
-    return (owner == my_tid);
+    uint8_t my_tid_low = (uint8_t)my_tid;
+    uint8_t owner = tiny_atomic_load_u8_relaxed(&meta->owner_tid_low);
+    return (owner == my_tid_low && owner != 0);
 }
 
 // Check if ptr belongs to current thread (Legacy TinySlab path)
@@ -112,8 +109,11 @@ static inline int tiny_free_fast_ss(SuperSlab* ss, int slab_idx, void* base, uin
         free_ss_debug_count++;
         int is_same = tiny_free_is_same_thread_ss(ss, slab_idx, my_tid);
         extern int g_sfc_enabled;
-        fprintf(stderr, "[FREE_SS] base=%p, cls=%d, same_thread=%d, sfc_enabled=%d\n",
-                base, ss->size_class, is_same, g_sfc_enabled);
+        fprintf(stderr, "[FREE_SS] base=%p, cls=%u, same_thread=%d, sfc_enabled=%d\n",
+                base,
+                meta->class_idx,
+                is_same,
+                g_sfc_enabled);
     }
 #endif
 
@@ -121,13 +121,13 @@ static inline int tiny_free_fast_ss(SuperSlab* ss, int slab_idx, void* base, uin
     if (__builtin_expect(!tiny_free_is_same_thread_ss(ss, slab_idx, my_tid), 0)) {
 #if HAKMEM_DEBUG_COUNTERS
         // Track cross-thread frees (compile-time gated)
-        g_free_via_ss_remote[ss->size_class]++;
+        g_free_via_ss_remote[meta->class_idx]++;
 #endif
         return 0;  // Cross-thread → caller should delegate to remote path
     }
 
     // Fast path: Same-thread free (2-3 instructions)
-    int class_idx = ss->size_class;
+    int class_idx = meta->class_idx;
     // Phase E1-CORRECT: base pointer already converted by caller (no double conversion!)
 
 #if HAKMEM_DEBUG_COUNTERS