Two-Speed HOT PATH: Guard hak_super_lookup calls with HAKMEM_BUILD_RELEASE

Phase E2 introduced registry lookup to the hot path, causing 84-88% regression
(70M → 9M ops/sec). This commit restores performance by guarding expensive
hak_super_lookup calls (50-100 cycles each) with conditional compilation.

Key changes:
- tls_sll_box.h push: Full validation in Debug, ss_fast_lookup (O(1)) in Release
- tls_sll_box.h pop: Registry validation in Debug, trust list structure in Release
- tiny_free_fast_v2.inc.h: Header/meta cross-check Debug-only
- malloc_tiny_fast.h: SuperSlab registration check Debug-only

Performance improvement:
- Release build: 2.9M → 87-88M ops/sec (30x improvement)
- Restored to historical UNIFIED-HEADER peak (70-80M range)

Release builds trust:
- Header magic (0xA0) as sufficient allocation origin validation
- TLS SLL linked list structure integrity
- Header-based class_idx classification

Debug builds maintain full validation with expensive registry lookups.

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

core/tiny_free_fast_v2.inc.h

@@ -162,6 +162,9 @@ static inline int hak_tiny_free_fast_v2(void* ptr) {
         fprintf(stderr, "[TINY_FREE_V2] After read_header, class_idx=%d\n", class_idx);
     }
     #endif
+    // TWO-SPEED: Header/meta cross-check is DEBUG-ONLY to keep HOT PATH fast.
+    // In Release builds, we trust the header-based classification.
+#if !HAKMEM_BUILD_RELEASE
     // Cross-check header class vs meta class (if available from fast lookup)
     do {
         // Try fast owner slab lookup to get meta->class_idx for comparison
@@ -191,6 +194,7 @@ static inline int hak_tiny_free_fast_v2(void* ptr) {
             }
         }
     } while (0);
+#endif  // !HAKMEM_BUILD_RELEASE
 
     // Check if header read failed (invalid magic in debug, or out-of-bounds class_idx)
     if (__builtin_expect(class_idx < 0, 0)) {