index: a leaf record's payload becomes the document's slab offset

PLAN amendment A3. The B+tree leaf had nowhere to put a document's slab
offset -- `Slot.extra` is the payload length for a leaf and the child node id
for an internal separator -- which is what blocks the `_id_` tree from becoming
the primary lookup once the docs hashmap goes away.

A leaf record is now `key ++ offset_le`, so `extra` is always 8 and every
byte-accounting site (fits, record_cost, slot_cost, balanced_cut,
repack_keep_prefix) is untouched. Records get *smaller*: an ObjectId `_id_`
record goes from 26 bytes to 21.

`Entry.id` is deleted rather than re-owned. Every entry one document
contributes shares one document, so which document it is belongs on the call
that commits the entries -- which also makes it impossible to confuse the
offset a replace is removing with the one it is inserting. The old field
aliased the docs map's key and was only safe because removal happened at the
one chokepoint where a document dies; that constraint is gone.

Done for secondary indexes too, not just `_id_`. That deletes the per-candidate
`coll.docs.get(id)` in scan_sorted outright rather than replacing it with an
`_id_` descent, and it is free on the write path because a replace already
removes and reinserts every entry in every index.

Consequences worth knowing:

- lookup_eq/lookup_range/Plan.search yield u64. Those are values, immune to the
  tree mutation that invalidated the id slices they used to hand back -- which
  is why ttl_sweep_coll can drop the dupe-and-free dance it needed to survive
  `remove` freeing the key its entries pointed at.
- One safety net is gone. A stale entry used to be swallowed by
  `docs.get(id) orelse continue`; now it resolves to superseded-but-parseable
  bytes the re-applied filter might accept. That trades an invisible
  under-approximation for a visible wrong answer, which is the better failure
  to have, but it is a trade.
- A checkpoint may never renumber slab offsets (already recorded in PLAN §4):
  every index leaf now holds a physical one.

`zig build fuzz` earned its keep immediately -- it caught the API break in all
four B+tree harnesses, which `zig build test` cannot see.

Benchmarks A/B'd at 256m on one harness, before and after: all rows flat.
updateMany and deleteOne+insertOne first looked 10-13% slower, which three
repeat runs showed to be single-sample noise (0.70/0.71/0.70 against 0.70).

src/spill.zig

@@ -35,7 +35,7 @@ pub fn main() !void {
         pairs[0] = .{ .key = "_id", .value = .{ .int32 = @intCast(i) } };
         pairs[1] = .{ .key = "tag", .value = .{ .string = strings[i] } };
         docs[i] = try doc_of(gpa, &pairs);
-        _ = try ix.add_doc(gpa, docs[i], &[_]u8{ 'i', 'd', @intCast(i + 1) }, true);
+        _ = try ix.add_doc(gpa, docs[i], @intCast(i + 1), true);
     }
     std.debug.print("count={d} leaves={d} depth={d} overflow={d}\n", .{
         ix.count(),
@@ -47,25 +47,25 @@ pub fn main() !void {
 
     // Every entry is found by exact key.
     for (lens, 0..) |_, i| {
-        var out: std.ArrayListUnmanaged([]const u8) = .empty;
+        var out: std.ArrayListUnmanaged(u64) = .empty;
         defer out.deinit(gpa);
         try ix.lookup_eq(gpa, &.{.{ .string = strings[i] }}, &out);
         if (out.items.len != 1) {
             std.debug.print("lookup {d} got {d}\n", .{ i, out.items.len });
             return error.Bad;
         }
-        if (!std.mem.eql(u8, out.items[0], &[_]u8{ 'i', 'd', @intCast(i + 1) })) return error.Bad;
+        if (out.items[0] != i + 1) return error.Bad;
     }
 
     // Delete the spilled ones and the inline ones alternately.
     for (lens, 0..) |_, i| {
         if (i % 2 == 0) continue;
-        ix.remove_doc(gpa, docs[i], &[_]u8{ 'i', 'd', @intCast(i + 1) });
+        ix.remove_doc(gpa, docs[i], @intCast(i + 1));
     }
     if (ix.count() != 3) return error.Bad;
     for (lens, 0..) |_, i| {
         if (i % 2 == 0) continue;
-        var out: std.ArrayListUnmanaged([]const u8) = .empty;
+        var out: std.ArrayListUnmanaged(u64) = .empty;
         defer out.deinit(gpa);
         try ix.lookup_eq(gpa, &.{.{ .string = strings[i] }}, &out);
         if (out.items.len != 0) return error.Bad;