slab/multislab/pool: reject bad releases, fix limits, add LIBMEM_ASSERT

[aotodev]

• multislab::deallocate rejects a foreign or misaligned pointer, a double
  free and end() before touching bookkeeping; slab::deallocate(_at)
  return whether they released
• grow() no longer leaks the node when the slab allocation throws
• slab clamps memory past MaxBlocks instead of asserting
• valid_slab_geometry rejects sizes that overflow size_t; bitmap
  indices are computed in size_t
• pool::erase asserts it != end(); slab_limit is explicit and range
  checked
• every runtime check goes through LIBMEM_ASSERT, contract_assert
  under LIBMEM_CONTRACTS; not usable yet on GCC 16

Closes #6