Unify Unified Cache API to BASE-only pointer type with Phantom typing

Core Changes:
- Modified: core/front/tiny_unified_cache.h
  * API signatures changed to use hak_base_ptr_t (Phantom type)
  * unified_cache_pop() returns hak_base_ptr_t (was void*)
  * unified_cache_push() accepts hak_base_ptr_t base (was void*)
  * unified_cache_pop_or_refill() returns hak_base_ptr_t (was void*)
  * Added #include "../box/ptr_type_box.h" for Phantom types

- Modified: core/front/tiny_unified_cache.c
  * unified_cache_refill() return type changed to hak_base_ptr_t
  * Uses HAK_BASE_FROM_RAW() for wrapping return values
  * Uses HAK_BASE_TO_RAW() for unwrapping parameters
  * Maintains internal void* storage in slots array

- Modified: core/box/tiny_front_cold_box.h
  * Uses hak_base_ptr_t from unified_cache_refill()
  * Uses hak_base_is_null() for NULL checks
  * Maintains tiny_user_offset() for BASE→USER conversion
  * Cold path refill integration updated to Phantom types

- Modified: core/front/malloc_tiny_fast.h
  * Free path wraps BASE pointer with HAK_BASE_FROM_RAW()
  * When pushing to Unified Cache via unified_cache_push()

Design Rationale:
- Unified Cache API now exclusively handles BASE pointers (no USER mixing)
- Phantom types enforce type distinction at compile time (debug mode)
- Zero runtime overhead in Release mode (macros expand to identity)
- Hot paths (tiny_hot_alloc_fast, tiny_hot_free_fast) remain unchanged
- Layout consistency maintained via tiny_user_offset() Box

Validation:
- All 25 Phantom type usage sites verified (25/25 correct)
- HAK_BASE_FROM_RAW(): 5/5 correct wrappings
- HAK_BASE_TO_RAW(): 1/1 correct unwrapping
- hak_base_is_null(): 4/4 correct NULL checks
- Compilation: RELEASE=0 and RELEASE=1 both successful
- Smoke tests: 3/3 passed (simple_alloc, loop 10M, pool_tls)

Type Safety Benefits:
- Prevents USER/BASE pointer confusion at API boundaries
- Compile-time checking in debug builds via Phantom struct
- Zero cost abstraction in release builds
- Clear intent: Unified Cache exclusively stores BASE pointers

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/front/tiny_unified_cache.c

@@ -292,14 +292,14 @@ static inline int unified_refill_validate_base(int class_idx,
 }
 
 // Batch refill from SuperSlab (called on cache miss)
-// Returns: BASE pointer (first block), or NULL if failed
+// Returns: BASE pointer (first block, wrapped), or NULL-wrapped if failed
 // Design: Direct carve from SuperSlab to array (no TLS SLL intermediate layer)
-void* unified_cache_refill(int class_idx) {
+hak_base_ptr_t unified_cache_refill(int class_idx) {
     TinyTLSSlab* tls = &g_tls_slabs[class_idx];
 
     // Step 1: Ensure SuperSlab available
     if (!tls->ss) {
-        if (!superslab_refill(class_idx)) return NULL;
+        if (!superslab_refill(class_idx)) return HAK_BASE_FROM_RAW(NULL);
         tls = &g_tls_slabs[class_idx];  // Reload after refill
     }
 
@@ -322,7 +322,7 @@ void* unified_cache_refill(int class_idx) {
         room = cache->capacity - (cache->tail - cache->head) - 1;
     }
 
-    if (room <= 0) return NULL;
+    if (room <= 0) return HAK_BASE_FROM_RAW(NULL);
     if (room > 128) room = 128;  // Batch size limit
 
     // Step 3: Direct carve from SuperSlab into local array (bypass TLS SLL!)
@@ -425,7 +425,7 @@ void* unified_cache_refill(int class_idx) {
         }
     }
 
-    if (produced == 0) return NULL;
+    if (produced == 0) return HAK_BASE_FROM_RAW(NULL);
 
     // Step 4: Update active counter
     // Guard: tls->ss can be NULL if all SuperSlab refills failed
@@ -444,5 +444,5 @@ void* unified_cache_refill(int class_idx) {
     g_unified_cache_miss[class_idx]++;
     #endif
 
-    return first;  // Return first block (BASE pointer)
+    return HAK_BASE_FROM_RAW(first);  // Return first block (BASE pointer)
 }