feat(runtime): phase 2 — fixed slab, per-slot packed-atomic state machine, raw cold locks

The slot table split (ROADMAP_v0.5 phase 2): slot lookup is lock-free, the
run path (yield/park/unpark/pop/resume) takes zero locks beyond the queue
mutex itself, and SharedState shrinks to { run_queue }.

Core pieces:

- src/raw_mutex.rs: hand-rolled 3-state futex mutex (Drepper mutex3),
  non-poisoning; the guard enters NoPreempt, which both bounds hold times and
  structurally closes the unwind-under-lock hole (the stop sentinel shares
  the gate). Used for per-slot cold data, the free list, and the stack pool.

- Fixed slab Box<[Slot]> (default max_actors = 16_384, ~4 MiB, align(128)
  against false sharing). Slots never move -> stable addresses, lock-free
  index. Exhaustion panics loudly, naming Config::max_actors(n) as the fix.
  Unbounded/segmented slab stays deferred (see ROADMAP).

- Per-slot AtomicU64 packing (generation << 32 | state), states
  Vacant/Queued/Running/RunningNotified/Parked/Done. Every transition CASes
  the packed word, so the generation check is atomic with the transition: no
  ABA, no spurious unparks on recycled slots. RunningNotified replaces the
  pending_unpark bool (the lost-wakeup window is a state, not a flag) and
  uniformly fixes a LATENT LOST WAKEUP in the old Blocking-IO completion
  path, which set the result for a still-Running actor without flagging it.

- Invariant: a pid is in the run queue at most once (pushes pair 1:1 with
  transitions into Queued; only the scheduler does Queued->Running). This is
  what makes phase 3's bounded rings sound.

- sp -> relaxed AtomicUsize; stop flag + first-resume closure as AtomicPtrs
  (closure double-boxed for a thin pointer, swap-to-take): the resume path is
  fully atomic.

- finalize_actor: Done published under the dying slot's cold lock (join's
  check-or-register is linearized by it); link cascade locks peers ONE AT A
  TIME (cold locks are leaves) with the acyclicity argument written at the
  site; link() registers on the target first, then self (stale self-entries
  are benign, every walk re-verifies the peer's word).

- Termination by counters: live_actors incremented in spawn pre-enqueue,
  decremented at the very END of finalize after all wakeup enqueues; exit on
  io_out == 0 (read before the queue lock, phase-1 ordering) && queue empty
  && live == 0. Soundness note at the site: any enqueue targets a live actor.

- spawn boxes the closure and acquires the stack BEFORE any runtime lock: no
  allocation ever happens under a global lock anymore.

- with_runtime/try_with_runtime now enter NoPreempt for their full span.
  This fixes a bug the rework exposed: install_actor allocated with
  preemption enabled while the RUNTIME RefCell borrow was live; a timeslice
  preemption there migrates the actor across OS threads and the borrow guard
  increments one thread's RefCell count and decrements another's — underflow
  to 'permanently mutably borrowed', cascading panics (caught by stress
  suite: deterministic non-unwinding-panic abort in lost_wakeup_many_pairs).
  The old code was safe only by accident; now it's structural.

- Behavior note: request_stop on a RUNNING target now marks it
  RunningNotified, so its next park returns immediately to an observation
  point — faster stop observation; parked/queued/done semantics unchanged.

Validated: 22 suites green in release (1/2/8-thread oversubscribed on the
1-core sandbox) and in debug with all debug_asserts live; stress suite x5.

src/monitor.rs

@@ -47,7 +47,6 @@
 
 use crate::channel::{channel, Receiver, Sender};
 use crate::pid::Pid;
-use crate::runtime::State;
 use crate::scheduler::with_runtime;
 
 /// Why a monitored actor went down.
@@ -110,23 +109,24 @@ pub struct Monitor {
 pub fn monitor(target: Pid) -> Monitor {
     let (tx, rx) = channel::<Down>();
 
-    // Register under the shared lock. We allocate the id and (if the target is
-    // live) clone the sender into its monitor list, keeping the original `tx`
-    // for the NoProc fallback. `tx.clone()` only touches the channel's own
-    // mutex, never the shared runtime mutex, so it is safe under the lock — but
-    // we must not *send* here, as `Sender::send` can call back in to unpark a
-    // parked receiver and the shared mutex is not reentrant.
+    // Register under the target's cold lock. `tx.clone()` only touches the
+    // channel's own mutex, never any runtime lock, so it is safe here — but
+    // we must not *send* under the lock, as `Sender::send` can unpark a
+    // parked receiver, and there's no reason to nest that.
     let (id, registered) = with_runtime(|inner| {
         let id = inner.alloc_monitor_id();
-        let registered = inner.with_shared(|s| {
-            match s.slot_mut(target) {
-                Some(slot) if !matches!(slot.state, State::Done) => {
-                    slot.monitors.push((id, tx.clone()));
+        let registered = match inner.slot_at(target) {
+            Some(slot) => {
+                let mut cold = slot.cold.lock();
+                if slot.is_live_for(target) {
+                    cold.monitors.push((id, tx.clone()));
                     true
+                } else {
+                    false
                 }
-                _ => false,
             }
-        });
+            None => false,
+        };
         (id, registered)
     });
 
@@ -147,16 +147,18 @@ pub fn monitor(target: Pid) -> Monitor {
 /// dropping the [`Monitor`] closes its receiver and the queued notice goes with
 /// it — the analogue of Erlang's `demonitor(Ref, [flush])`.
 pub fn demonitor(m: &Monitor) -> Option<MonitorId> {
-    // Remove the registration under the lock, but move the `Sender` *out* and
-    // let it drop only after the lock is released: dropping the last sender
-    // runs `Sender::drop`, which may unpark a parked receiver → `with_shared`,
-    // and the shared mutex is not reentrant.
+    // Remove the registration under the target's cold lock, but move the
+    // `Sender` *out* and let it drop only after the lock is released:
+    // dropping the last sender runs `Sender::drop`, which may unpark a parked
+    // receiver — legal under a cold lock, but pointless to nest.
     let removed: Option<(MonitorId, Sender<Down>)> = with_runtime(|inner| {
-        inner.with_shared(|s| {
-            let slot = s.slot_mut(m.target)?;
-            let pos = slot.monitors.iter().position(|(mid, _)| *mid == m.id)?;
-            Some(slot.monitors.remove(pos))
-        })
+        let slot = inner.slot_at(m.target)?;
+        let mut cold = slot.cold.lock();
+        if slot.generation() != m.target.generation() {
+            return None; // slot reused; the Down already fired
+        }
+        let pos = cold.monitors.iter().position(|(mid, _)| *mid == m.id)?;
+        Some(cold.monitors.remove(pos))
     });
     // `removed`'s sender drops here, outside the lock.
     removed.map(|(id, _sender)| id)