Phase 6-2.7: Add fallback to tiny_remote_side_get() (partial fix)

Problem:
- tiny_remote_side_set() has fallback: writes to node memory if table full
- tiny_remote_side_get() had NO fallback: returns 0 when lookup fails
- This breaks remote queue drain chain traversal
- Remaining nodes stay in queue with sentinel 0xBADA55BADA55BADA
- Later allocations return corrupted nodes → SEGV

Changes:
- core/tiny_remote.c:598-606
  - Added fallback to read from node memory when side table lookup fails
  - Added sentinel check: return 0 if sentinel present (entry was evicted)
  - Matches set() behavior at line 583

Result:
- Improved (but not complete fix)
- Freelist corruption still occurs
- Issue appears deeper than simple side table lookup failure

Next:
- SuperSlab refactoring needed (500+ lines in .h)
- Root cause investigation with ultrathink

Related commits:
- b8ed2b05b: Phase 6-2.6 (slab_data_start consistency)
- d2f0d8458: Phase 6-2.5 (constants + 2048 offset)

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

core/tiny_remote.c

@@ -595,7 +595,15 @@ uintptr_t tiny_remote_side_get(struct SuperSlab* ss, int slab_idx, void* node) {
         }
         if (key == 0) break;
     }
-    return 0;
+    // Fallback: If side table lookup failed (table overflow during push),
+    // read embedded next pointer from node memory (matches set() fallback at line 583)
+    uintptr_t fallback_val = atomic_load_explicit((_Atomic uintptr_t*)node, memory_order_acquire);
+    // If sentinel is present, it means the entry WAS in side table but got evicted
+    // In this case, we can't recover the next pointer - return 0 to stop chain traversal
+    if (fallback_val == TINY_REMOTE_SENTINEL) {
+        return 0;
+    }
+    return fallback_val;
 }
 
 void tiny_remote_side_clear(struct SuperSlab* ss, int slab_idx, void* node) {