Refactor: Extract TLS Bind Box for unified slab binding

- Created core/box/ss_tls_bind_box.h containing ss_tls_bind_one().
- Refactored superslab_refill() to use the new box.
- Updated signatures to avoid circular dependencies (tiny_self_u32).
- Added future integration points for Warm Pool and Page Box.

core/box/tiny_page_box.h

@@ -13,6 +13,12 @@
 //       `max` BASE pointers using per-page freelist before falling back.
 //   - When disabled for a class: the box returns 0 and caller uses legacy path.
 //
+//   - TLS Bind:
+//       Future direction: The Page Box will select a (SuperSlab, slab_idx)
+//       pair and use ss_tls_bind_one() to bind it to TLS. Subsequent
+//       allocations will carve directly from that TLS-bound slab,
+//       clarifying the boundary between Superslab Backend and TLS Bind.
+//
 // ENV:
 //   HAKMEM_TINY_PAGE_BOX_CLASSES (optional)
 //     - Comma-separated class indices, e.g. "7" or "5,6,7"
@@ -37,7 +43,7 @@ extern void ss_active_add(SuperSlab* ss, uint32_t n);
 // 最大保持ページ数（1クラスあたり）
 // C7 専用実験では 1〜2 枚あれば十分だが、将来 C5/C6 にも拡張することを考え 4 枚まで許容する。
 #ifndef TINY_PAGE_BOX_MAX_PAGES
-#define TINY_PAGE_BOX_MAX_PAGES 4
+#define TINY_PAGE_BOX_MAX_PAGES 12
 #endif
 
 // 1 ページ分のメタデータ
@@ -191,6 +197,12 @@ static inline void tiny_page_box_on_new_slab(TinyTLSSlab* tls)
 
     // Page Box で追跡している間は Superslab を pin しておく
     superslab_ref_inc(ss);
+
+#if !HAKMEM_BUILD_RELEASE
+    // Debug: Track Page Box stats per-class
+    fprintf(stderr, "[PAGE_BOX_REG] class=%d num_pages=%u capacity=%u carved=%u\n",
+            class_idx, st->num_pages, meta->capacity, meta->carved);
+#endif
 }
 
 // Phase 1 implementation strategy: