[M1-ALLOC-01] Zero sim-loop allocation assertion (G-R1)

[offdev]

Implements roadmap step M1-ALLOC-01 · Zero sim-loop allocation assertion (G-R1) (roadmap/M1-heartbeat.md), scope bullets only.

What

• The allocation watch — new src/laige-core/alloc_watch.{h,cpp}: a process-wide heap-allocation counter behind strong global operator new/new[] (+ nothrow, + sized deletes), compiled into every non-sanitizer tree (LAIGE_ALLOC_WATCH=1 PUBLIC; sanitizer trees degrade to inline no-ops — the fallback is the leak-free sanitizer run + the pool reservation delta, the M0-CORE-02/05 pattern). Armed-window model: allocWatchArm() (3 relaxed stores) / allocWatchRead() (2 relaxed loads → AllocWatchReading{allocs, firstSite}); the first offending call site is the allocating call's own return address (the GCC/Clang builtin, MSVC __return_address), first offender wins via a relaxed CAS.
• The per-tick assertion — GameLoop::runOneTick (debug builds): arm before the tick body, read after a completed tick; allocs ≠ 0 → one alloc/sim_tick_allocation Error event (fields tick/allocs/site) + the debug assert (FR-12.3: actionable, never silent). Failed ticks are not checked. Release compiles the check out (pool-overflow degradation + the simAllocs delta remain). This is the standing hot-path guardrail for every later sim/render step (roadmap README §6).
• The attribution contract — the engine's own cold-path event emission inside a tick (a G-R5 budget_overrun/budget_critical, a replay record_failed, a guardrail warn) is the diagnostic subsystem's memory, not the sim loop's: the logging facade's emit path wraps its work in laige::detail::LoggingAllocationGuard (the LAIGE_LOG macro block + Logger::record), so those documented degradations still log and never trip G-R1 — while any other in-tick allocation still fails at its call site.

Tests (ctest -R zero_alloc)

• ZeroAlloc.TenKWorkloadThroughTheLoopAllocatesNothing — the 10k-entity M1-ECS-07 workload through the GameLoop (700 direct warm-up ticks + 10k ticks @ 60 Hz synthetic clock, kTickNs = 16666667 = ceil(1e9/60)): per-tick window 0 allocs, reservation delta 0, rows/entity invariants, FNV-1a checksum.
• ZeroAlloc.ScratchSystemAllocationFailsTheTickAssertion — a deliberate std::vector in a scratch system fails the assertion (forked SIGABRT child; the Verify clause's deliberate-then-revert scratch, kept as the standing negative test — the violation lives in the test TU only).
• ZeroAlloc.WatchCountsAllocationsAndCapturesTheFirstSite — the watch's own counting + first-site capture.
• engine_tests HeadlessFramePathAllocatesNothing now reads per-tick window semantics (the engine's three one-shot setup allocations land before the first arm).

Verification (local)

• ctest -R zero_alloc green; full canonical ctest 92/92; and 92/92 on build-release, build-shared, build-asan, build-tsan, build-clang.
• Zero warnings on every tree; tools/laige-determinism-lint + tools/laige-include-lint OK.
• laige-api.json regenerated (820 symbols from 25 headers); api-real-tree green.

Docs (same change, CORE-006/DOC-007)

• docs/api/alloc_watch.md (new): window model, the per-tick assertion, the attribution contract, release builds, scope, cost, threading, misuse, example.
• docs/api/game_loop.md: the "The zero-allocation check (M1-ALLOC-01, G-R1)" section + the Performance cost line; docs/api/profiler.md cross-ref; docs/README.md index.

Roadmap: box checked, Progress Board M1 22→23 / Total 40→41, Change Log row (commit/PR recorded in the follow-up commit, house convention).