Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 alloc direct path (WIP, -2% regression)

Add C0-C3 early-exit optimization to malloc_tiny_fast() similar to
FREE-TINY-FAST-DUALHOT-1. Skip policy snapshot for C0-C3 classes.

A/B Result (10-run, Mixed TINYV3_C7_SAFE):
- Baseline: 47.27M ops/s (median)
- Optimized: 46.10M ops/s (median)
- Result: -2.00% (regression, needs investigation)

ENV: HAKMEM_TINY_ALLOC_DUALHOT=0/1 (default OFF)

Implementation:
- core/front/malloc_tiny_fast.h: alloc_dualhot_enabled() + early-exit
- Design: docs/analysis/ALLOC_TINY_FAST_DUALHOT_1_DESIGN.md

Status: Research box (default OFF), needs root cause analysis

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -129,6 +129,17 @@ static inline int front_gate_unified_enabled(void) {
 //   - USER pointer on success
 //   - NULL on failure (caller falls back to normal path)
 //
+
+// Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 early-exit gate (default OFF)
+static inline int alloc_dualhot_enabled(void) {
+    static int g = -1;
+    if (__builtin_expect(g == -1, 0)) {
+        const char* e = getenv("HAKMEM_TINY_ALLOC_DUALHOT");
+        g = (e && *e && *e != '0') ? 1 : 0;
+    }
+    return g;
+}
+
 __attribute__((always_inline))
 static inline void* malloc_tiny_fast(size_t size) {
     // Phase ALLOC-GATE-OPT-1: カウンタ散布 (1. 関数入口)
@@ -155,6 +166,18 @@ static inline void* malloc_tiny_fast(size_t size) {
         // C7 ULTRA miss → fall through to policy-based routing
     }
 
+    // Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 direct path (second hot path)
+    // Skip expensive policy snapshot and route determination for C0-C3.
+    // Measurements show C0-C3 is 48% of allocations, not rare.
+    if (__builtin_expect(alloc_dualhot_enabled() && class_idx <= 3, 0)) {
+        // Direct to LEGACY unified cache (no policy snapshot)
+        void* ptr = tiny_hot_alloc_fast(class_idx);
+        if (TINY_HOT_LIKELY(ptr != NULL)) {
+            return ptr;
+        }
+        return tiny_cold_refill_and_alloc(class_idx);
+    }
+
     // 2. Policy snapshot (TLS cached, single read)
     const SmallPolicyV7* policy = small_policy_v7_snapshot();
     SmallRouteKind route_kind = policy->route_kind[class_idx];