Phase TLS-UNIFY-3: C6 intrusive freelist implementation (完成)

Implement C6 ULTRA intrusive LIFO freelist with ENV gating:
- Single-linked LIFO using next pointer at USER+1 offset
- tiny_next_store/tiny_next_load for pointer access (single source of truth)
- Segment learning via ss_fast_lookup (per-class seg_base/seg_end)
- ENV gate: HAKMEM_TINY_C6_ULTRA_INTRUSIVE_FL (default OFF)
- Counters: c6_ifl_push/pop/fallback in FREE_PATH_STATS

Files:
- core/box/tiny_ultra_tls_box.h: Added c6_head field for intrusive LIFO
- core/box/tiny_ultra_tls_box.c: Pop/push with intrusive branching (case 6)
- core/box/tiny_c6_ultra_intrusive_env_box.h: ENV gate (new)
- core/box/tiny_c6_intrusive_freelist_box.h: L1 pure LIFO (new)
- core/tiny_debug_ring.h: C6_IFL events
- core/box/free_path_stats_box.h/c: c6_ifl_* counters

A/B Test Results (1M iterations, ws=200, 257-512B):
- ENV_OFF (array): 56.6 Mop/s avg
- ENV_ON (intrusive): 57.6 Mop/s avg (+1.8%, within noise)
- Counters verified: c6_ifl_push=265890, c6_ifl_pop=265815, fallback=0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/box/free_path_stats_box.h

@@ -11,6 +11,9 @@ typedef struct FreePathStats {
     uint64_t c7_ultra_fast;
     uint64_t c6_ultra_free_fast;   // Phase 4-2: C6 ULTRA-free
     uint64_t c6_ultra_alloc_hit;   // Phase 4-4: C6 ULTRA-alloc (TLS pop)
+    uint64_t c6_ifl_push;          // Phase TLS-UNIFY-3: C6 intrusive push
+    uint64_t c6_ifl_pop;           // Phase TLS-UNIFY-3: C6 intrusive pop
+    uint64_t c6_ifl_fallback;      // Phase TLS-UNIFY-3: C6 intrusive fallback (slow)
     uint64_t c5_ultra_free_fast;   // Phase 5-1: C5 ULTRA-free
     uint64_t c5_ultra_alloc_hit;   // Phase 5-2: C5 ULTRA-alloc (TLS pop)
     uint64_t c4_ultra_free_fast;   // Phase 6: C4 ULTRA-free (cap=64)