Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)

Merge separate g_tls_sll_head[] and g_tls_sll_count[] arrays into unified
TinyTLSSLL struct to improve L1D cache locality. Expected performance gain:
+12-18% from reducing cache line splits (2 loads → 1 load per operation).

Changes:
- core/hakmem_tiny.h: Add TinyTLSSLL type (16B aligned, head+count+pad)
- core/hakmem_tiny.c: Replace separate arrays with g_tls_sll[8]
- core/box/tls_sll_box.h: Update Box API (13 sites) for unified access
- Updated 32+ files: All g_tls_sll_head[i] → g_tls_sll[i].head
- Updated 32+ files: All g_tls_sll_count[i] → g_tls_sll[i].count
- core/hakmem_tiny_integrity.h: Unified canary guards
- core/box/integrity_box.c: Simplified canary validation
- Makefile: Added core/box/tiny_sizeclass_hist_box.o to link

Build: ✅ PASS (10K ops sanity test)
Warnings: Only pre-existing LTO type mismatches (unrelated)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/tiny_free_fast_v2.inc.h

@@ -33,8 +33,7 @@
 #if HAKMEM_TINY_HEADER_CLASSIDX
 
 // External TLS variables (defined in hakmem_tiny.c)
-extern __thread void* g_tls_sll_head[TINY_NUM_CLASSES];
-extern __thread uint32_t g_tls_sll_count[TINY_NUM_CLASSES];
+extern __thread TinyTLSSLL g_tls_sll[TINY_NUM_CLASSES];
 extern int g_tls_sll_enable;  // Honored for fast free: when 0, fall back to slow path
 
 // External functions
@@ -135,7 +134,7 @@ static inline int hak_tiny_free_fast_v2(void* ptr) {
     //    Cost: 1 comparison (~1 cycle, predict-not-taken)
     //    Benefit: Fail-safe against TLS SLL pollution from false positives
     uint32_t cap = (uint32_t)TINY_TLS_MAG_CAP;
-    if (__builtin_expect(g_tls_sll_count[class_idx] >= cap, 0)) {
+    if (__builtin_expect(g_tls_sll[class_idx].count >= cap, 0)) {
         return 0;  // Route to slow path for spill (Front Gate will catch corruption)
     }