Phase FREE-LEGACY-OPT-6: C4 ULTRA Implementation

Implement C4 ULTRA free TLS cache with parasitic free+alloc pattern,
achieving 99.7-99.9% elimination of C4 legacy fallback calls.

Key Features:
- TLS cache cap=64 (tuned for L1 cache fit, smaller than C5/C6's 128)
- Segment learning via ss_fast_lookup() on first free
- Free-side cache push + alloc-side TLS pop pattern
- ENV gate: HAKMEM_TINY_C4_ULTRA_FREE_ENABLED (default OFF)
- Full FREE_PATH_STATS instrumentation

Benchmark Results:
C4-heavy (65-128B range):
  - C4 legacy: 591,583 → 1,711 (-99.7%)
  - c4_ultra cache hits: ~599k (free) + ~599k (alloc)
  - Mixed load: 340,732 → 284 C4 legacy (-99.9%)

Legacy fallback reduction:
  - C4-heavy: 589,872 fewer legacy calls (-10.9% total)
  - Mixed: 340,448 fewer C4 legacy calls (-12.8% in mixed)

Performance note: ~2% throughput cost in isolated C4-heavy case,
acceptable tradeoff for 99%+ legacy elimination per class.

Files:
  NEW: core/box/tiny_c4_ultra_free_box.h/c
  NEW: core/box/tiny_c4_ultra_free_env_box.h
  MOD: core/box/tiny_ultra_classes_box.h (added C4 macros)
  MOD: core/box/free_path_stats_box.h/c (C4 ULTRA counters)
  MOD: core/front/malloc_tiny_fast.h (C4 alloc+free integration)
  MOD: Makefile (added C4 ULTRA object)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -48,7 +48,8 @@
 #include "../box/tiny_c7_ultra_box.h" // C7 ULTRA stub (UF-1, delegates to v3)
 #include "../box/tiny_c6_ultra_free_box.h" // Phase 4-2: C6 ULTRA-free (free-only, C6-only)
 #include "../box/tiny_c5_ultra_free_box.h" // Phase 5-1/5-2: C5 ULTRA-free + alloc integration
-#include "../box/tiny_ultra_classes_box.h" // Phase REFACTOR-1: Named constants for C6/C7
+#include "../box/tiny_c4_ultra_free_box.h" // Phase 6: C4 ULTRA-free + alloc integration (cap=64)
+#include "../box/tiny_ultra_classes_box.h" // Phase REFACTOR-1: Named constants for C4-C7
 #include "../box/tiny_legacy_fallback_box.h" // Phase REFACTOR-2: Legacy fallback logic unification
 #include "../box/tiny_ptr_convert_box.h" // Phase REFACTOR-3: Inline pointer macro centralization
 #include "../box/tiny_front_v3_env_box.h" // Tiny front v3 snapshot gate
@@ -193,6 +194,16 @@ static inline void* malloc_tiny_fast(size_t size) {
         }
     }
 
+    // Phase 6: C4 ULTRA free+alloc integration (same pattern as C5/C6, cap=64)
+    if (tiny_class_is_c4(class_idx) && tiny_c4_ultra_free_enabled()) {
+        TinyC4UltraFreeTLS* ctx = tiny_c4_ultra_free_tls();
+        if (TINY_HOT_LIKELY(ctx->count > 0)) {
+            void* base = ctx->freelist[--ctx->count];
+            FREE_PATH_STAT_INC(c4_ultra_alloc_hit);
+            return tiny_base_to_user_inline(base);
+        }
+    }
+
     switch (route) {
         case TINY_ROUTE_SMALL_HEAP_V6: {
             // Phase FREE-LEGACY-BREAKDOWN-1: v6 は既存のビルドエラーがあるため一時的にスキップ
@@ -336,6 +347,12 @@ static inline int free_tiny_fast(void* ptr) {
         return 1;
     }
 
+    // Phase 6: C4 ULTRA-free (C4-only, free-only, ENV gated, same pattern as C5/C6)
+    if (tiny_class_is_c4(class_idx) && tiny_c4_ultra_free_enabled()) {
+        tiny_c4_ultra_free_fast(base, class_idx);
+        return 1;
+    }
+
     // C7 v3 fast classify: bypass classify_ptr/ss_map_lookup for clear hits
     if (class_idx == 7 &&
         tiny_front_v3_enabled() &&