Phase 7-1.1: Fix 1024B crash (header validation + malloc fallback)

Fixed critical bugs preventing Phase 7 from working with 1024B allocations.

## Bug Fixes (by Task Agent Ultrathink)

1. **Header Validation Missing in Release Builds**
   - `core/tiny_region_id.h:73-97` - Removed `#if !HAKMEM_BUILD_RELEASE`
   - Always validate magic byte and class_idx (prevents SEGV on Mid/Large)

2. **1024B Malloc Fallback Missing**
   - `core/box/hak_alloc_api.inc.h:35-49` - Direct fallback to malloc
   - Phase 7 rejects 1024B (needs header) → skip ACE → use malloc

## Test Results

| Test | Result |
|------|--------|
| 128B, 512B, 1023B (Tiny) | +39%~+436% ✅ |
| 1024B only (100 allocs) | 100% success ✅ |
| Mixed 128B+1024B (200) | 100% success ✅ |
| bench_random_mixed 1024B | Still crashes ❌ |

## Known Issue

`bench_random_mixed` with 1024B still crashes (intermittent SEGV).
Simple tests pass, suggesting issue is with complex allocation patterns.
Investigation pending.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Task Agent Ultrathink

core/tiny_free_fast_v2.inc.h

@@ -53,13 +53,12 @@ static inline int hak_tiny_free_fast_v2(void* ptr) {
     // 1. Read class_idx from header (2-3 cycles, L1 hit)
     int class_idx = tiny_region_id_read_header(ptr);
 
-#if !HAKMEM_BUILD_RELEASE
-    // Debug: Validate header
+    // CRITICAL: Always validate header (even in release)
+    // Reason: Mid/Large allocations don't have headers, reading ptr-1 would SEGV
     if (__builtin_expect(class_idx < 0, 0)) {
         // Invalid header - route to slow path (non-header allocation)
         return 0;
     }
-#endif
 
     // 2. Check TLS freelist capacity (optional, for bounded cache)
     //    Note: Can be disabled in release for maximum speed