fuzz: harness blind to iterator and capacity bugs #7

fuzz/fuzz_multislab.cpp could not catch the slab iterator and list rework bugs, because it:

• counts reachable blocks only from a fresh begin() and never holds an iterator across an operation;
• accepts nullptr from allocate() under a cap without checking free capacity;
• has no pool harness.

Land after the slab iterator and list rework fixes, or CI goes red.

Add

• Held-iterator opcode: take an iterator (begin() or from allocate_at), run N ops, finish the traversal. Never visit a freed block. Visit blocks live for the whole traversal exactly once, others at most once.
• Sweep opcode: erase-while-iterating with a byte-driven predicate, compared against a reference multiset.
• Under a cap, allocate() succeeds iff live < max_slabs * BlocksPerSlab.
• fuzz_pool.cpp: the same ops over pool<T> with a T that tracks its own liveness. Also check size() and erase's return value. Wire into fuzz/CMakeLists.txt and fuzz.yml.