Phase 7 follow-up: header-aware in BG spill, TLS drain, and aggressive inline macros

- bg_spill: link/traverse next at base+1 for C0–C6, base for C7
- lifecycle: drain TLS SLL and fast caches reading next with header-aware offsets
- tiny_alloc_fast_inline: POP/PUSH macros made header-aware to match tls_sll_box rules
- add optional FREE_WRAP_ENTER trace (HAKMEM_FREE_WRAP_TRACE) for early triage

Result: 0xa0/…0099 bogus free logs gone; remaining SIGBUS appears in free path early. Next: instrument early libc fallback or guard invalid pointers during init to pinpoint source.

core/box/hak_free_api.inc.h

@@ -72,6 +72,18 @@ void hak_free_at(void* ptr, size_t size, hak_callsite_t site) {
     HKM_TIME_START(t0);
 #endif
     (void)site; (void)size;
+    // Optional lightweight trace of early free calls (first few only)
+    static int free_trace_en = -1; static _Atomic int free_trace_count = 0;
+    if (__builtin_expect(free_trace_en == -1, 0)) {
+        const char* e = getenv("HAKMEM_FREE_WRAP_TRACE");
+        free_trace_en = (e && *e && *e != '0') ? 1 : 0;
+    }
+    if (free_trace_en) {
+        int n = atomic_fetch_add(&free_trace_count, 1);
+        if (n < 8) {
+            fprintf(stderr, "[FREE_WRAP_ENTER] ptr=%p\n", ptr);
+        }
+    }
     if (!ptr) {
 #if HAKMEM_DEBUG_TIMING
         HKM_TIME_END(HKM_CAT_HAK_FREE, t0);