Phase 7: header-aware TLS front caches and FG gating

- core/hakmem_tiny_fastcache.inc.h: make tiny_fast_pop/push read/write next at base+1 for C0–C6; clear C7 next on pop
- core/hakmem_tiny_hot_pop.inc.h: header-aware next reads for g_fast_head pops (classes 0–3)
- core/tiny_free_magazine.inc.h: header-aware chain linking for BG spill chain (base+1 for C0–C6)
- core/box/front_gate_classifier.c: registry fallback classifies headerless only for class 7; others as headered

Build OK; bench_fixed_size_hakmem still SIGBUS right after init. FREE_ROUTE trace shows invalid frees (ptr=0xa0, etc.). Next steps: instrument early frees and audit remaining header-aware writes in any front caches not yet patched.

core/tiny_alloc_fast.inc.h

@@ -272,8 +272,13 @@ static inline int sfc_refill_from_sll(int class_idx, int target_count) {
             break;  // SLL empty
         }
 
-        // Push to SFC (Layer 0)
-        *(void**)ptr = g_sfc_head[class_idx];
+        // Push to SFC (Layer 0) — header-aware
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        const size_t sfc_next_off = (class_idx == 7) ? 0 : 1;
+#else
+        const size_t sfc_next_off = 0;
+#endif
+        *(void**)((uint8_t*)ptr + sfc_next_off) = g_sfc_head[class_idx];
         g_sfc_head[class_idx] = ptr;
         g_sfc_count[class_idx]++;