Tiny: fix header/stride mismatch and harden refill paths

- Root cause: header-based class indexing (HEADER_CLASSIDX=1) wrote a 1-byte
  header during allocation, but linear carve/refill and initial slab capacity
  still used bare class block sizes. This mismatch could overrun slab usable
  space and corrupt freelists, causing reproducible SEGV at ~100k iters.

Changes
- Superslab: compute capacity with effective stride (block_size + header for
  classes 0..6; class7 remains headerless) in superslab_init_slab(). Add a
  debug-only bound check in superslab_alloc_from_slab() to fail fast if carve
  would exceed usable bytes.
- Refill (non-P0 and P0): use header-aware stride for all linear carving and
  TLS window bump operations. Ensure alignment/validation in tiny_refill_opt.h
  also uses stride, not raw class size.
- Drain: keep existing defense-in-depth for remote sentinel and sanitize nodes
  before splicing into freelist (already present).

Notes
- This unifies the memory layout across alloc/linear-carve/refill with a single
  stride definition and keeps class7 (1024B) headerless as designed.
- Debug builds add fail-fast checks; release builds remain lean.

Next
- Re-run Tiny benches (256/1024B) in debug to confirm stability, then in
  release. If any remaining crash persists, bisect with HAKMEM_TINY_P0_BATCH_REFILL=0
  to isolate P0 batch carve, and continue reducing branch-miss as planned.

core/pool_tls_arena.h

@@ -0,0 +1,31 @@
+#ifndef HAKMEM_POOL_TLS_ARENA_H
+#define HAKMEM_POOL_TLS_ARENA_H
+
+#include <stddef.h>
+
+// Configuration
+#define POOL_SIZE_CLASSES 7
+extern int g_arena_max_growth_level;     // 0..N (3 => 8MB cap)
+extern size_t g_arena_initial_chunk_size; // bytes (default 1MB)
+
+// TLS Arena Chunk
+typedef struct {
+    void*  chunk_base;      // mmap base address (page-aligned)
+    size_t chunk_size;      // Current chunk size (1/2/4/8 MB)
+    size_t offset;          // Next carve offset
+    int    growth_level;    // 0=1MB, 1=2MB, 2=4MB, 3=8MB
+} PoolChunk;
+
+// API
+// Carve 'count' blocks from TLS Arena for 'class_idx'
+// Returns number of blocks carved (0 on OOM)
+int arena_batch_carve(int class_idx, void** out_blocks, int count);
+
+// Thread cleanup (munmap all chunks)
+void arena_cleanup_thread(void);
+
+#ifdef POOL_TLS_ARENA_DEBUG
+void arena_print_stats(void);
+#endif
+
+#endif // HAKMEM_POOL_TLS_ARENA_H