Phase 7: header-aware TLS front caches and FG gating

- core/hakmem_tiny_fastcache.inc.h: make tiny_fast_pop/push read/write next at base+1 for C0–C6; clear C7 next on pop
- core/hakmem_tiny_hot_pop.inc.h: header-aware next reads for g_fast_head pops (classes 0–3)
- core/tiny_free_magazine.inc.h: header-aware chain linking for BG spill chain (base+1 for C0–C6)
- core/box/front_gate_classifier.c: registry fallback classifies headerless only for class 7; others as headered

Build OK; bench_fixed_size_hakmem still SIGBUS right after init. FREE_ROUTE trace shows invalid frees (ptr=0xa0, etc.). Next steps: instrument early frees and audit remaining header-aware writes in any front caches not yet patched.

core/tiny_alloc_fast_sfc.inc.h

@@ -75,18 +75,23 @@ extern sfc_stats_t g_sfc_stats[TINY_NUM_CLASSES];
 // Contract: Caller owns returned pointer
 // Invariants: count ≥ 0, all pointers belong to correct class
 static inline void* sfc_alloc(int cls) {
-    void* head = g_sfc_head[cls];
+    void* base = g_sfc_head[cls];
 
-    if (__builtin_expect(head != NULL, 1)) {
-        // Pop: 3 instructions (mimalloc/tcache style)
-        g_sfc_head[cls] = *(void**)head;  // next = *head
+    if (__builtin_expect(base != NULL, 1)) {
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        const size_t next_offset = (cls == 7) ? 0 : 1;
+#else
+        const size_t next_offset = 0;
+#endif
+        // Pop: header-aware next
+        g_sfc_head[cls] = *(void**)((uint8_t*)base + next_offset);
         g_sfc_count[cls]--;               // count--
 
 #if HAKMEM_DEBUG_COUNTERS
         g_sfc_stats[cls].alloc_hits++;
 #endif
 
-        return head;  // 🚀 SFC HIT!
+        return base;  // 🚀 SFC HIT! (returns base)
     }
 
 #if HAKMEM_DEBUG_COUNTERS
@@ -114,9 +119,14 @@ static inline int sfc_free_push(int cls, void* ptr) {
     }
 
     if (__builtin_expect(cnt < cap, 1)) {
-        // Push: 3 instructions
-        *(void**)ptr = g_sfc_head[cls];  // *ptr = head
-        g_sfc_head[cls] = ptr;           // head = ptr
+#if HAKMEM_TINY_HEADER_CLASSIDX
+        const size_t next_offset = (cls == 7) ? 0 : 1;
+#else
+        const size_t next_offset = 0;
+#endif
+        // Push: header-aware next placement
+        *(void**)((uint8_t*)ptr + next_offset) = g_sfc_head[cls];
+        g_sfc_head[cls] = ptr;           // head = base
         g_sfc_count[cls] = cnt + 1;      // count++
 
 #if HAKMEM_DEBUG_COUNTERS