Tiny: Enable P0 batch refill by default + docs and task update

Summary
- Default P0 ON: Build-time HAKMEM_TINY_P0_BATCH_REFILL=1 remains; runtime gate now defaults to ON
  (HAKMEM_TINY_P0_ENABLE unset or not '0'). Kill switch preserved via HAKMEM_TINY_P0_DISABLE=1.
- Fix critical bug: After freelist→SLL batch splice, increment TinySlabMeta::used by 'from_freelist'
  to mirror non-P0 behavior (prevents under-accounting and follow-on carve invariants from breaking).
- Add low-overhead A/B toggles for triage: HAKMEM_TINY_P0_NO_DRAIN (skip remote drain),
  HAKMEM_TINY_P0_LOG (emit [P0_COUNTER_OK/MISMATCH] based on total_active_blocks delta).
- Keep linear carve fail-fast guards across simple/general/TLS-bump paths.

Perf (1T, 100k×256B)
- P0 OFF: ~2.73M ops/s (stable)
- P0 ON (no drain): ~2.45M ops/s
- P0 ON (normal drain): ~2.76M ops/s (fastest)

Known
- Rare [P0_COUNTER_MISMATCH] warnings persist (non-fatal). Continue auditing active/used
  balance around batch freelist splice and remote drain splice.

Docs
- Add docs/TINY_P0_BATCH_REFILL.md (runtime switches, behavior, perf notes).
- Update CURRENT_TASK.md with Tiny P0 status (default ON) and next steps.

core/tiny_free_fast_v2.inc.h

@@ -17,6 +17,7 @@
 #pragma once
 #include "tiny_region_id.h"
 #include "hakmem_build_flags.h"
+#include "hakmem_tiny_config.h"  // For TINY_TLS_MAG_CAP, TINY_NUM_CLASSES
 
 // Phase 7: Header-based ultra-fast free
 #if HAKMEM_TINY_HEADER_CLASSIDX
@@ -28,7 +29,6 @@ extern __thread uint32_t g_tls_sll_count[TINY_NUM_CLASSES];
 // External functions
 extern void hak_tiny_free(void* ptr);  // Fallback for non-header allocations
 extern uint32_t sll_cap_for_class(int class_idx, uint32_t mag_cap);
-extern int TINY_TLS_MAG_CAP;
 
 // ========== Ultra-Fast Free (Header-based) ==========