index: a leaf record's payload becomes the document's slab offset

PLAN amendment A3. The B+tree leaf had nowhere to put a document's slab
offset -- `Slot.extra` is the payload length for a leaf and the child node id
for an internal separator -- which is what blocks the `_id_` tree from becoming
the primary lookup once the docs hashmap goes away.

A leaf record is now `key ++ offset_le`, so `extra` is always 8 and every
byte-accounting site (fits, record_cost, slot_cost, balanced_cut,
repack_keep_prefix) is untouched. Records get *smaller*: an ObjectId `_id_`
record goes from 26 bytes to 21.

`Entry.id` is deleted rather than re-owned. Every entry one document
contributes shares one document, so which document it is belongs on the call
that commits the entries -- which also makes it impossible to confuse the
offset a replace is removing with the one it is inserting. The old field
aliased the docs map's key and was only safe because removal happened at the
one chokepoint where a document dies; that constraint is gone.

Done for secondary indexes too, not just `_id_`. That deletes the per-candidate
`coll.docs.get(id)` in scan_sorted outright rather than replacing it with an
`_id_` descent, and it is free on the write path because a replace already
removes and reinserts every entry in every index.

Consequences worth knowing:

- lookup_eq/lookup_range/Plan.search yield u64. Those are values, immune to the
  tree mutation that invalidated the id slices they used to hand back -- which
  is why ttl_sweep_coll can drop the dupe-and-free dance it needed to survive
  `remove` freeing the key its entries pointed at.
- One safety net is gone. A stale entry used to be swallowed by
  `docs.get(id) orelse continue`; now it resolves to superseded-but-parseable
  bytes the re-applied filter might accept. That trades an invisible
  under-approximation for a visible wrong answer, which is the better failure
  to have, but it is a trade.
- A checkpoint may never renumber slab offsets (already recorded in PLAN §4):
  every index leaf now holds a physical one.

`zig build fuzz` earned its keep immediately -- it caught the API break in all
four B+tree harnesses, which `zig build test` cannot see.

Benchmarks A/B'd at 256m on one harness, before and after: all rows flat.
updateMany and deleteOne+insertOne first looked 10-13% slower, which three
repeat runs showed to be single-sample noise (0.70/0.71/0.70 against 0.70).

src/spill2.zig

@@ -22,11 +22,8 @@ pub fn main() !void {
     // 5000 docs, each with a 2 KiB key: spills on every record, forcing
     // leaves and internal nodes to hold overflow references.
     const N = 5000;
-    var ids: std.ArrayListUnmanaged([]u8) = .empty;
-    defer {
-        for (ids.items) |x| gpa.free(x);
-        ids.deinit(gpa);
-    }
+    var ids: std.ArrayListUnmanaged(u64) = .empty;
+    defer ids.deinit(gpa);
     var pairs: [2]bson.Pair = undefined;
     var buf = try gpa.alloc(u8, 2000);
     defer gpa.free(buf);
@@ -41,7 +38,7 @@ pub fn main() !void {
         std.mem.writeInt(u32, buf[0..4], @intCast(i), .little);
         const key = try gpa.dupe(u8, buf);
         try facts.append(gpa, .{ .key = key });
-        const id = try std.fmt.allocPrint(gpa, "id{d}", .{i});
+        const id: u64 = @intCast(i + 1);
         try ids.append(gpa, id);
         pairs[0] = .{ .key = "_id", .value = .{ .int32 = @intCast(i) } };
         pairs[1] = .{ .key = "tag", .value = .{ .string = key } };
@@ -61,10 +58,10 @@ pub fn main() !void {
     const rand2 = prng2.random();
     for (0..300) |_| {
         const i = rand2.intRangeAtMost(usize, 0, N - 1);
-        var out: std.ArrayListUnmanaged([]const u8) = .empty;
+        var out: std.ArrayListUnmanaged(u64) = .empty;
         defer out.deinit(gpa);
         try ix.lookup_eq(gpa, &.{.{ .string = facts.items[i].key }}, &out);
-        if (out.items.len != 1 or !std.mem.eql(u8, out.items[0], ids.items[i])) {
+        if (out.items.len != 1 or out.items[0] != ids.items[i]) {
             std.debug.print("lookup mismatch at {d}\n", .{i});
             return error.Bad;
         }
@@ -87,7 +84,7 @@ pub fn main() !void {
         }
     }
     for (order.items) |i| {
-        var out: std.ArrayListUnmanaged([]const u8) = .empty;
+        var out: std.ArrayListUnmanaged(u64) = .empty;
         defer out.deinit(gpa);
         try ix.lookup_eq(gpa, &.{.{ .string = facts.items[i].key }}, &out);
         if (out.items.len != 0) return error.Bad;