v7-5b/v7-7: Fix free path for C5 and Learner route switching

Bug fixes:
- Free path now handles C5 (not just C6) for v7 routing
- After Learner route switch, old V7 pointers are correctly freed
  via V7 (instead of being misrouted to legacy)

Change: Always try V7 free for SMALL_V7_CLASS_SUPPORTED classes
(C5/C6). V7 returns false if ptr is not in V7 segment, allowing
proper fallback to legacy for non-V7 pointers.

This fix is essential because Learner may dynamically switch
C5 from V7→MID_V3, but pointers allocated before the switch
still reside in V7 segments and must be freed via V7.

Performance (C5/C6 workload 200-500B):
- v7 OFF: ~19M ops/s
- v7+Learner: ~43M ops/s (+126%)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -405,9 +405,11 @@ static inline int free_tiny_fast(void* ptr) {
         return 1;
     }
 
-    // Phase v7-4: Check Policy Box for v7 routing (before route lookup)
+    // Phase v7-5b/v7-7: Always try V7 free for supported classes (C5/C6)
-    const SmallPolicyV7* policy = small_policy_v7_snapshot();
+    // V7 returns false if ptr is not in V7 segment.
-    if (class_idx == 6 && policy->route_kind[class_idx] == SMALL_ROUTE_V7) {
+    // This is necessary because Learner may switch routes dynamically,
+    // but pointers allocated before the switch still need V7 free.
+    if (SMALL_V7_CLASS_SUPPORTED(class_idx)) {
         if (small_heap_free_fast_v7_stub(ptr, (uint8_t)class_idx)) {
             FREE_PATH_STAT_INC(smallheap_v7_fast);
             return 1;