Fix magazine spill RAW pointer type conversion for Headerless mode

Problem: bulk_mag_to_sll_if_room() was passing raw pointers directly to
tls_sll_push() without HAK_BASE_FROM_RAW() conversion, causing memory
corruption in Headerless mode where pointer arithmetic expectations differ.

Solution: Add HAK_BASE_FROM_RAW() wrapper before passing to tls_sll_push()

Verification:
- cfrac: PASS (Headerless ON/OFF)
- sh8bench: PASS (Headerless ON/OFF)
- No regressions in existing tests

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

core/hakmem_tiny_refill.inc.h

@@ -225,7 +225,8 @@ static inline int bulk_mag_to_sll_if_room(int class_idx, TinyTLSMag* mag, int n)
     int pushed = 0;
     for (int i = 0; i < take; i++) {
         void* p = mag->items[--mag->top].ptr;
-        if (!tls_sll_push(class_idx, p, cap)) {
+        hak_base_ptr_t base_p = HAK_BASE_FROM_RAW(p);
+        if (!tls_sll_push(class_idx, base_p, cap)) {
             mag->top++; // rollback last
             break;
         }