perf: serve GET by reference + single table probe (drop the value copy + double find)

[ELares]

Parent: #507. Est. 8-12% (including removing the 2nd probe).

Problem

Two wasteful things on the GET hot path:

1. cmd_get does Bytes::copy_from_slice(value) (cmd_string.rs:261) then encode put_slice into out = 2 value copies + 1 alloc. Redis/Dragonfly serve the inline value by reference: write $<len>\r\n<bytes>\r\n straight from the stored bytes into the output buffer = 1 write, 0 alloc, 1 copy (store to socket buffer, the only intrinsic one).
2. The store does find_mut().bump_freq() then find() (store lib.rs:981,984) = 2 SIMD group walks where 1 suffices (bump the freq + read the value through the same &mut).

Mechanism / fix

• Add a borrowing GET path: encode $len\r\n + the value bytes directly from store.read's &[u8] into out (or a Value::BulkRef(&[u8]) variant), collapsing GET to a single store-to-out copy.
• Return the value + bump the frequency through ONE find_mut (or one probe that both reads and bumps).

Risk / notes

• Eviction-in-flight guard only matters if later combined with io_uring registered-buffer writes (a separate [EPIC] Close the Dragonfly GET gap + own the tail-latency/determinism niche #507 sub-issue); for the plain synchronous copy here the value is copied into out before the next command, so no pinning is needed.
• Composes with the encode-into-out change (perf: encode RESP replies straight into the output buffer (drop per-reply BytesMut) #505, already merged).

Acceptance

• GET does 1 value copy (store to out) + 1 table probe.
• Byte-identical (differential green); store + server tests pass.
• A/B target: 8-12% GET.