Phase 7: header-aware TLS front caches and FG gating

- core/hakmem_tiny_fastcache.inc.h: make tiny_fast_pop/push read/write next at base+1 for C0–C6; clear C7 next on pop
- core/hakmem_tiny_hot_pop.inc.h: header-aware next reads for g_fast_head pops (classes 0–3)
- core/tiny_free_magazine.inc.h: header-aware chain linking for BG spill chain (base+1 for C0–C6)
- core/box/front_gate_classifier.c: registry fallback classifies headerless only for class 7; others as headered

Build OK; bench_fixed_size_hakmem still SIGBUS right after init. FREE_ROUTE trace shows invalid frees (ptr=0xa0, etc.). Next steps: instrument early frees and audit remaining header-aware writes in any front caches not yet patched.

core/hakmem_tiny_fastcache.inc.h

@@ -79,7 +79,13 @@ static inline __attribute__((always_inline)) void* tiny_fast_pop(int class_idx)
     if (cap == 0) return NULL;
     void* head = g_fast_head[class_idx];
     if (!head) return NULL;
-    void* next = *(void**)head;
+    // Phase 7: header-aware next pointer (C0-C6: base+1, C7: base)
+#if HAKMEM_TINY_HEADER_CLASSIDX
+    const size_t next_offset = (class_idx == 7) ? 0 : 1;
+#else
+    const size_t next_offset = 0;
+#endif
+    void* next = *(void**)((uint8_t*)head + next_offset);
     g_fast_head[class_idx] = next;
     uint16_t count = g_fast_count[class_idx];
     if (count > 0) {
@@ -112,7 +118,13 @@ static inline __attribute__((always_inline)) int tiny_fast_push(int class_idx, v
         tiny_fast_debug_log(class_idx, "full", count, cap);
         return 0;
     }
-    *(void**)ptr = g_fast_head[class_idx];
+    // Phase 7: header-aware next pointer (C0-C6: base+1, C7: base)
+#if HAKMEM_TINY_HEADER_CLASSIDX
+    const size_t next_offset2 = (class_idx == 7) ? 0 : 1;
+#else
+    const size_t next_offset2 = 0;
+#endif
+    *(void**)((uint8_t*)ptr + next_offset2) = g_fast_head[class_idx];
     g_fast_head[class_idx] = ptr;
     g_fast_count[class_idx] = (uint16_t)(count + 1);
     g_fast_push_hits[class_idx]++;