Centralize layout calculations: Use tiny_user_offset() instead of hardcoded -1 offset

- Modified core/tiny_free_fast.inc.h to use tiny_user_offset(legacy_class)
- Eliminates hardcoded -1 offset in legacy TinySlab free path
- Aligns with layout box refactoring: single source of truth in tiny_layout_box.h
- Verified: smoke test passes, sh8bench runs for 120+ seconds without segfault

This completes the layout box consolidation migration for the free fast path.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/tiny_free_fast.inc.h

@@ -241,8 +241,10 @@ static inline void tiny_free_fast(void* ptr) {
     // 2. Legacy TinySlab-backed pointer?
     TinySlab* slab = hak_tiny_owner_slab(ptr);
     if (__builtin_expect(slab != NULL, 0)) {
-        // Convert USER → BASE (for Legacy path)
-        void* base_legacy = (void*)((uint8_t*)ptr - 1);
+        // Convert USER → BASE (for Legacy path) using centralized layout
+        int legacy_class = slab->class_idx;
+        size_t user_off = tiny_user_offset(legacy_class);
+        void* base_legacy = (void*)((uint8_t*)ptr - user_off);
 
         // Box 6 Boundary: Try same-thread fast path
         // CRITICAL: Pass BASE pointer (already converted above)