Add per-allocator mutex for transfer_all/transfer_free

[canlin-zhang]

Summary

Each PoolAllocator now has its own std::mutex (transfer_mutex). transfer_all and transfer_free lock only the destination's mutex before mutating its internal state.

The source allocator is not locked — it is assumed to be accessed only by its owning thread (typically a thread_local instance being emptied before the thread exits).

Why destination-only locking?

• Source: thread-local, single-writer — no contention
• Destination: shared target that multiple worker threads may transfer into concurrently — needs protection
• No deadlock: only one mutex locked at a time per transfer call
• Not a hot path: called once per threaded simulation run (~20ns uncontended)

Changes

• pool_allocator.h: Add #include <mutex>, add mutable std::mutex transfer_mutex private member, update doc comments
• pool_allocator.tcc: Add std::lock_guard in transfer_all and transfer_free

Test plan

• All 14 existing tests pass