Phase REFACTOR-2: Legacy Fallback Logic Unification

Consolidate duplicated legacy free logic into a single reusable function.
Previously, hak_tiny_free_legacy_inline() and hak_tiny_free_legacy_impl()
contained identical implementations in malloc_tiny_fast.h and
tiny_c6_ultra_free_box.c.

Changes:
- NEW: core/box/tiny_legacy_fallback_box.h
  - tiny_legacy_fallback_free_base(): Unified legacy free implementation
  - Encapsulates: Unified Cache push + per-class stats + final fallback
  - Contract: BASE pointer input (already extracted from USER ptr)

- Modified: core/front/malloc_tiny_fast.h
  - Removed: hak_tiny_free_legacy_inline() (lines 96-111)
  - Replaced call: hak_tiny_free_legacy_inline → tiny_legacy_fallback_free_base

- Modified: core/box/tiny_c6_ultra_free_box.c
  - Removed: hak_tiny_free_legacy_impl() (lines 17-39)
  - Replaced call: hak_tiny_free_legacy_impl → tiny_legacy_fallback_free_base

Benefits:
- Single source of truth (DRY principle)
- Easier to maintain and test
- Consistent behavior across all free paths
- No performance impact (always_inline preserved)

No semantic changes - identical logic, just centralized.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/box/tiny_legacy_fallback_box.h

@@ -0,0 +1,44 @@
+#ifndef HAKMEM_TINY_LEGACY_FALLBACK_BOX_H
+#define HAKMEM_TINY_LEGACY_FALLBACK_BOX_H
+
+#include <stdbool.h>
+#include <stdint.h>
+#include "../front/tiny_unified_cache.h"
+#include "../hakmem.h"
+#include "tiny_front_v3_env_box.h"
+#include "free_path_stats_box.h"
+#include "tiny_front_hot_box.h"
+
+// Purpose: Encapsulate legacy free logic (shared by multiple paths)
+// Called by: malloc_tiny_fast.h (free path) + tiny_c6_ultra_free_box.c (C6 fallback)
+//
+// Contract:
+//   - base: BASE pointer (already extracted via ptr - 1)
+//   - class_idx: size class (0-7)
+//   - Returns: void (always succeeds or falls back to tiny_hot_free_fast)
+//
+__attribute__((always_inline))
+static inline void tiny_legacy_fallback_free_base(void* base, uint32_t class_idx) {
+    const TinyFrontV3Snapshot* front_snap =
+        __builtin_expect(tiny_front_v3_enabled(), 0) ? tiny_front_v3_snapshot_get() : NULL;
+
+    // Legacy fallback - Unified Cache push
+    if (!front_snap || front_snap->unified_cache_on) {
+        if (unified_cache_push(class_idx, HAK_BASE_FROM_RAW(base))) {
+            FREE_PATH_STAT_INC(legacy_fallback);
+
+            // Per-class breakdown (Phase 4-1)
+            if (__builtin_expect(free_path_stats_enabled(), 0)) {
+                if (class_idx < 8) {
+                    g_free_path_stats.legacy_by_class[class_idx]++;
+                }
+            }
+            return;
+        }
+    }
+
+    // Final fallback
+    tiny_hot_free_fast(class_idx, base);
+}
+
+#endif // HAKMEM_TINY_LEGACY_FALLBACK_BOX_H