Phase 7 follow-up: header-aware in BG spill, TLS drain, and aggressive inline macros

- bg_spill: link/traverse next at base+1 for C0–C6, base for C7
- lifecycle: drain TLS SLL and fast caches reading next with header-aware offsets
- tiny_alloc_fast_inline: POP/PUSH macros made header-aware to match tls_sll_box rules
- add optional FREE_WRAP_ENTER trace (HAKMEM_FREE_WRAP_TRACE) for early triage

Result: 0xa0/…0099 bogus free logs gone; remaining SIGBUS appears in free path early. Next: instrument early libc fallback or guard invalid pointers during init to pinpoint source.

core/hakmem_tiny_lifecycle.inc

@@ -149,7 +149,12 @@ static void tiny_tls_cache_drain(int class_idx) {
     g_tls_sll_head[class_idx] = NULL;
     g_tls_sll_count[class_idx] = 0;
     while (sll) {
-        void* next = *(void**)sll;
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        const size_t next_off_sll = (class_idx == 7) ? 0 : 1;
+#else
+        const size_t next_off_sll = 0;
+#endif
+        void* next = *(void**)((uint8_t*)sll + next_off_sll);
         tiny_tls_list_guard_push(class_idx, tls, sll);
         tls_list_push(tls, sll);
         sll = next;
@@ -160,7 +165,12 @@ static void tiny_tls_cache_drain(int class_idx) {
     g_fast_head[class_idx] = NULL;
     g_fast_count[class_idx] = 0;
     while (fast) {
-        void* next = *(void**)fast;
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        const size_t next_off_fast = (class_idx == 7) ? 0 : 1;
+#else
+        const size_t next_off_fast = 0;
+#endif
+        void* next = *(void**)((uint8_t*)fast + next_off_fast);
         tiny_tls_list_guard_push(class_idx, tls, fast);
         tls_list_push(tls, fast);
         fast = next;