Phase FREE-LEGACY-OPT-4-4: C6 ULTRA free+alloc integration

Parasitic TLS cache: alloc now pops from the TLS freelist filled by free.

Implementation:
- malloc_tiny_fast(): C6 class-specific TLS pop check before route switch
  - if (class_idx == 6 && tiny_c6_ultra_free_enabled())
  - pop from TinyC6UltraFreeTLS.freelist[--count]
  - return USER pointer (BASE + 1)

- FreePathStats: Added c6_ultra_alloc_hit counter for observability

Results (Mixed 16-1024B):
- OFF: 40.2M ops/s baseline
- ON:  42.2M ops/s (+4.9%) stable

Per-profile:
- Mixed:     +4.9% (40.2M → 42.2M)
- C6-heavy:  +7.6% (40.7M → 43.8M)

Free-alloc loop:
- free: TLS push (all C6 frees)
- alloc: TLS pop (all C6 allocs in steady state)
- Cache never fills, no legacy overflow
- C6 legacy_by_class reduced from 137K to 0 (100% elimination)

Key insight:
- Free-only TLS cache fails without alloc integration
- Once integrated, creates perfect load-balancing loop
- Alloc drains exactly what free fills

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

core/box/free_path_stats_box.c

@@ -16,10 +16,11 @@ static void free_path_stats_dump(void) {
         return;
     }
 
-    fprintf(stderr, "[FREE_PATH_STATS] total=%lu c7_ultra=%lu c6_ultra_free=%lu small_v3=%lu v6=%lu tiny_v1=%lu pool_v1=%lu remote=%lu super_lookup=%lu legacy_fb=%lu\n",
+    fprintf(stderr, "[FREE_PATH_STATS] total=%lu c7_ultra=%lu c6_ultra_free=%lu c6_ultra_alloc=%lu small_v3=%lu v6=%lu tiny_v1=%lu pool_v1=%lu remote=%lu super_lookup=%lu legacy_fb=%lu\n",
             g_free_path_stats.total_calls,
             g_free_path_stats.c7_ultra_fast,
             g_free_path_stats.c6_ultra_free_fast,  // Phase 4-2
+            g_free_path_stats.c6_ultra_alloc_hit,  // Phase 4-4
             g_free_path_stats.smallheap_v3_fast,
             g_free_path_stats.smallheap_v6_fast,
             g_free_path_stats.tiny_heap_v1_fast,