Phase TLS-UNIFY-3: C6 intrusive freelist implementation (完成)

Implement C6 ULTRA intrusive LIFO freelist with ENV gating:
- Single-linked LIFO using next pointer at USER+1 offset
- tiny_next_store/tiny_next_load for pointer access (single source of truth)
- Segment learning via ss_fast_lookup (per-class seg_base/seg_end)
- ENV gate: HAKMEM_TINY_C6_ULTRA_INTRUSIVE_FL (default OFF)
- Counters: c6_ifl_push/pop/fallback in FREE_PATH_STATS

Files:
- core/box/tiny_ultra_tls_box.h: Added c6_head field for intrusive LIFO
- core/box/tiny_ultra_tls_box.c: Pop/push with intrusive branching (case 6)
- core/box/tiny_c6_ultra_intrusive_env_box.h: ENV gate (new)
- core/box/tiny_c6_intrusive_freelist_box.h: L1 pure LIFO (new)
- core/tiny_debug_ring.h: C6_IFL events
- core/box/free_path_stats_box.h/c: c6_ifl_* counters

A/B Test Results (1M iterations, ws=200, 257-512B):
- ENV_OFF (array): 56.6 Mop/s avg
- ENV_ON (intrusive): 57.6 Mop/s avg (+1.8%, within noise)
- Counters verified: c6_ifl_push=265890, c6_ifl_pop=265815, fallback=0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

docs/analysis/ENV_PROFILE_PRESETS.md

@@ -39,6 +39,7 @@ HAKMEM_BENCH_MAX_SIZE=1024
 - `HAKMEM_TINY_FRONT_V3_LUT_ENABLED=1`
 - `HAKMEM_MID_V3_ENABLED=1`（Phase MID-V3: 257-768B, C6 only）
 - `HAKMEM_MID_V3_CLASSES=0x40`（C6 only, C7 は ULTRA に任せる）
+- `HAKMEM_MID_V35_ENABLED=0`（Phase v11a-5: Mixed では MID v3.5 OFF が最速）
 
 ### 任意オプション
 - stats を見たいとき:
@@ -85,6 +86,8 @@ HAKMEM_POOL_V2_ENABLED=0
 HAKMEM_POOL_V1_FLATTEN_ENABLED=0    # flatten は初回 OFF
 HAKMEM_MID_V3_ENABLED=1             # Phase MID-V3: 257-768B, C6 only
 HAKMEM_MID_V3_CLASSES=0x40          # C6 only (+11% on C6-heavy)
+HAKMEM_MID_V35_ENABLED=1            # Phase v11a-5: C6-heavy で +8% 改善
+HAKMEM_MID_V35_CLASSES=0x40         # C6 only (53.1M ops/s)
 ```
 - mid_desc_lookup TLS キャッシュを試すときだけ: `HAKMEM_MID_DESC_CACHE_ENABLED=1` を上乗せ（デフォルトは OFF）。