Implement Phantom typing for Tiny FastCache layer

Refactor FastCache and TLS cache APIs to use Phantom types (hak_base_ptr_t)
for compile-time type safety, preventing BASE/USER pointer confusion.

Changes:
1. core/hakmem_tiny_fastcache.inc.h:
   - fastcache_pop() returns hak_base_ptr_t instead of void*
   - fastcache_push() accepts hak_base_ptr_t instead of void*

2. core/hakmem_tiny.c:
   - Updated forward declarations to match new signatures

3. core/tiny_alloc_fast.inc.h, core/hakmem_tiny_alloc.inc:
   - Alloc paths now use hak_base_ptr_t for cache operations
   - BASE->USER conversion via HAK_RET_ALLOC macro

4. core/hakmem_tiny_refill.inc.h, core/refill/ss_refill_fc.h:
   - Refill paths properly handle BASE pointer types
   - Fixed: Removed unnecessary HAK_BASE_FROM_RAW() in ss_refill_fc.h line 176

5. core/hakmem_tiny_free.inc, core/tiny_free_magazine.inc.h:
   - Free paths convert USER->BASE before cache push
   - USER->BASE conversion via HAK_USER_TO_BASE or ptr_user_to_base()

6. core/hakmem_tiny_legacy_slow_box.inc:
   - Legacy path properly wraps pointers for cache API

Benefits:
- Type safety at compile time (in debug builds)
- Zero runtime overhead (debug builds only, release builds use typedef=void*)
- All BASE->USER conversions verified via Task analysis
- Prevents pointer type confusion bugs

Testing:
- Build: SUCCESS (all 9 files)
- Smoke test: PASS (sh8bench runs to completion)
- Conversion path verification: 3/3 paths correct

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/hakmem_tiny_fastcache.inc.h

@@ -81,12 +81,14 @@ static inline void tiny_fast_debug_log(int class_idx, const char* event, uint16_
 #endif
 
 // Basic fast cache operations
-static inline __attribute__((always_inline)) void* tiny_fast_pop(int class_idx) {
-    if (!g_fast_enable) return NULL;
+// NOTE: These APIs conceptually operate on BASE pointers.
+//       Interfaces use hak_base_ptr_t for type-safety; storage remains void*.
+static inline __attribute__((always_inline)) hak_base_ptr_t tiny_fast_pop(int class_idx) {
+    if (!g_fast_enable) return HAK_BASE_FROM_RAW(NULL);
     uint16_t cap = g_fast_cap[class_idx];
-    if (cap == 0) return NULL;
+    if (cap == 0) return HAK_BASE_FROM_RAW(NULL);
     void* head = g_fast_head[class_idx];
-    if (!head) return NULL;
+    if (!head) return HAK_BASE_FROM_RAW(NULL);
     // Phase 7: header-aware next pointer (C0-C6: base+1, C7: base)
 #if HAKMEM_TINY_HEADER_CLASSIDX
     // Phase E1-CORRECT: ALL classes have 1-byte header, next ptr at offset 1
@@ -105,10 +107,11 @@ static inline __attribute__((always_inline)) void* tiny_fast_pop(int class_idx)
         g_fast_count[class_idx] = 0;
     }
     // Phase E1-CORRECT: Return BASE pointer; caller (HAK_RET_ALLOC) performs BASE→USER
-    return head;
+    return HAK_BASE_FROM_RAW(head);
 }
 
-static inline __attribute__((always_inline)) int tiny_fast_push(int class_idx, void* ptr) {
+static inline __attribute__((always_inline)) int tiny_fast_push(int class_idx, hak_base_ptr_t base) {
+    void* ptr = HAK_BASE_TO_RAW(base);
     // NEW: Check Front-Direct/SLL-OFF bypass (priority check before any work)
     static __thread int s_front_direct_free = -1;
     if (__builtin_expect(s_front_direct_free == -1, 0)) {
@@ -184,19 +187,20 @@ static inline __attribute__((always_inline)) int tiny_fast_push(int class_idx, v
 }
 
 // Frontend fast cache operations
-static inline void* fastcache_pop(int class_idx) {
+static inline hak_base_ptr_t fastcache_pop(int class_idx) {
     TinyFastCache* fc = &g_fast_cache[class_idx];
     if (__builtin_expect(fc->top > 0, 1)) {
         void* base = fc->items[--fc->top];
         // ✅ FIX #16: Return BASE pointer (not USER)
         // FastCache stores base pointers. Caller will apply HAK_RET_ALLOC
         // which does BASE → USER conversion via tiny_region_id_write_header
-        return base;
+        return HAK_BASE_FROM_RAW(base);
     }
-    return NULL;
+    return HAK_BASE_FROM_RAW(NULL);
 }
 
-static inline int fastcache_push(int class_idx, void* ptr) {
+static inline int fastcache_push(int class_idx, hak_base_ptr_t base) {
+    void* ptr = HAK_BASE_TO_RAW(base);
     TinyFastCache* fc = &g_fast_cache[class_idx];
     if (__builtin_expect(fc->top < TINY_FASTCACHE_CAP, 1)) {
         fc->items[fc->top++] = ptr;