Phase 15: Box BenchMeta separation + ExternalGuard debug + investigation report

- Implement Box BenchMeta pattern in bench_random_mixed.c (BENCH_META_CALLOC/FREE)
- Add enhanced debug logging to external_guard_box.h (caller tracking, FG classification)
- Document investigation in PHASE15_BUG_ANALYSIS.md

Issue: Page-aligned MIDCAND pointer not in SuperSlab registry → ExternalGuard → crash
Hypothesis: May be pre-existing SuperSlab bug (not Phase 15-specific)
Next: Test in Phase 14-C to verify

core/tiny_free_fast_v2.inc.h

@@ -22,6 +22,7 @@
 #include "box/tls_sll_drain_box.h"  // Box TLS-SLL Drain (Option B)
 #include "hakmem_tiny_integrity.h"  // PRIORITY 1-4: Corruption detection
 #include "front/tiny_heap_v2.h"     // Phase 13-B: TinyHeapV2 magazine supply
+#include "front/tiny_ultra_hot.h"   // Phase 14: TinyUltraHot C1/C2 ultra-fast path
 
 // Phase 7: Header-based ultra-fast free
 #if HAKMEM_TINY_HEADER_CLASSIDX
@@ -131,6 +132,10 @@ static inline int hak_tiny_free_fast_v2(void* ptr) {
     //    Phase E1: ALL classes (C0-C7) have 1-byte header → base = ptr-1
     void* base = (char*)ptr - 1;
 
+    // Phase 14-C: UltraHot は free 時に横取りしない（Borrowing 設計）
+    // → 正史（TLS SLL）の在庫を正しく保つ
+    // → UltraHot refill は alloc 側で TLS SLL から借りる
+
     // Phase 13-B: TinyHeapV2 magazine supply (C0-C3 only)
     // Two supply modes (controlled by HAKMEM_TINY_HEAP_V2_LEFTOVER_MODE):
     //   Mode 0 (default): L0 gets blocks first ("stealing" design)