Fix NULL pointer crash in unified_cache_refill ss_active_add

When superslab_refill() fails in the inner loop, tls->ss can remain
NULL even when produced > 0 (from earlier successful allocations).
This caused a segfault at high iteration counts (>500K) in the
random_mixed benchmark.

Root cause: Line 353 calls ss_active_add(tls->ss, ...) without
checking if tls->ss is NULL after a failed refill breaks the loop.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/front/tiny_unified_cache.c

@@ -350,7 +350,10 @@ void* unified_cache_refill(int class_idx) {
     if (produced == 0) return NULL;
 
     // Step 4: Update active counter
+    // Guard: tls->ss can be NULL if all SuperSlab refills failed
+    if (tls->ss) {
         ss_active_add(tls->ss, (uint32_t)produced);
+    }
 
     // Step 5: Store blocks into unified cache (skip first, return it)
     void* first = out[0];