Tiny: fix header/stride mismatch and harden refill paths

- Root cause: header-based class indexing (HEADER_CLASSIDX=1) wrote a 1-byte
  header during allocation, but linear carve/refill and initial slab capacity
  still used bare class block sizes. This mismatch could overrun slab usable
  space and corrupt freelists, causing reproducible SEGV at ~100k iters.

Changes
- Superslab: compute capacity with effective stride (block_size + header for
  classes 0..6; class7 remains headerless) in superslab_init_slab(). Add a
  debug-only bound check in superslab_alloc_from_slab() to fail fast if carve
  would exceed usable bytes.
- Refill (non-P0 and P0): use header-aware stride for all linear carving and
  TLS window bump operations. Ensure alignment/validation in tiny_refill_opt.h
  also uses stride, not raw class size.
- Drain: keep existing defense-in-depth for remote sentinel and sanitize nodes
  before splicing into freelist (already present).

Notes
- This unifies the memory layout across alloc/linear-carve/refill with a single
  stride definition and keeps class7 (1024B) headerless as designed.
- Debug builds add fail-fast checks; release builds remain lean.

Next
- Re-run Tiny benches (256/1024B) in debug to confirm stability, then in
  release. If any remaining crash persists, bisect with HAKMEM_TINY_P0_BATCH_REFILL=0
  to isolate P0 batch carve, and continue reducing branch-miss as planned.

core/tiny_refill_opt.h

@@ -60,7 +60,8 @@ static inline void trc_splice_to_sll(int class_idx, TinyRefillChain* c,
     // CORRUPTION DEBUG: Validate chain before splicing
     if (__builtin_expect(trc_refill_guard_enabled(), 0)) {
         extern const size_t g_tiny_class_sizes[];
-        size_t blk = g_tiny_class_sizes[class_idx];
+        // Validate alignment using effective stride (include header for classes 0..6)
+        size_t blk = g_tiny_class_sizes[class_idx] + ((class_idx != 7) ? 1 : 0);
 
         fprintf(stderr, "[SPLICE_TO_SLL] cls=%d head=%p tail=%p count=%u\n",
                 class_idx, c->head, c->tail, c->count);
@@ -187,7 +188,13 @@ static inline uint32_t trc_linear_carve(uint8_t* base, size_t bs,
     }
 
     // FIX: Use carved counter (monotonic) instead of used (which decrements on free)
-    uint8_t* cursor = base + ((size_t)meta->carved * bs);
+    // Effective stride: account for Tiny header when enabled (classes 0..6)
+#if HAKMEM_TINY_HEADER_CLASSIDX
+    size_t stride = (bs == 1024 ? bs : (bs + 1));
+#else
+    size_t stride = bs;
+#endif
+    uint8_t* cursor = base + ((size_t)meta->carved * stride);
     void* head = (void*)cursor;
 
     // CORRUPTION DEBUG: Log carve operation
@@ -197,7 +204,7 @@ static inline uint32_t trc_linear_carve(uint8_t* base, size_t bs,
     }
 
     for (uint32_t i = 1; i < batch; i++) {
-        uint8_t* next = cursor + bs;
+        uint8_t* next = cursor + stride;
         *(void**)cursor = (void*)next;
         cursor = next;
     }