Kv: split iterator slot pool into independent primary and secondary pools

[heifner]

Summary

Pre-split, apply_context kept a single 1024-slot pool with each slot a union of fields for both iterator kinds. Hot paths loaded cache lines holding data the operation did not touch, and a contract iterating both kinds concurrently competed for the same 1024-slot budget.

This change splits the pool into independent primary and secondary pools with type-specific slot layouts, hardens the contract-visible iterator handle ABI, and caps the kv_it_create prefix size against an unbounded-allocation vector.

Pool split

• kv_iterator_slot_common holds the fields every iterator needs (in_use, status, code, table_id, cached_id).
• kv_primary_slot adds primary-only byte buffers (prefix, current_key).
• kv_secondary_slot adds secondary-only fields (current_sec_key, current_pri_key).
• kv_primary_iterator_pool and kv_secondary_iterator_pool each expose 1024 slots independently. A contract may now hold up to 1024 primary AND 1024 secondary iterators simultaneously.
• Both pools lazily resize on first allocate() -- actions that never touch KV iterators (e.g. sysio.token::transfer) pay zero heap for the pools.

Handle encoding (CONSENSUS-OBSERVABLE)

Handle values are contract-visible. Layout:

[ 0.. 9]  slot index (10 bits, covers max_kv_iterators = 1024)
[10..15]  RESERVED -- must be zero
[16    ]  secondary-pool tag (1 = secondary, 0 = primary)
[17..30]  RESERVED -- must be zero
[31    ]  always zero -- keeps handles positive when read as int32_t

Bit 16 was chosen over a high bit so handle values stay small and readable in logs (secondary handle 0x00010005 vs 0x40000005). Reserved bits give future protocol features room to encode e.g. generation counters without disturbing deployed contract code. Any change to this layout is a protocol change.

kv_handle_check_reserved_zero() is called at every host-intrinsic entry point that consumes a handle. A contract that fabricates a handle by setting reserved bits fails with a clean kv_invalid_iterator exception instead of silently aliasing a real slot.

Prefix-size bound on kv_it_create

Cap prefix_size at config::max_kv_key_size_limit (1024 B). The prefix bytes are memcpy'd into the iterator slot, so an unbounded prefix_size would let a contract allocate arbitrary host-side storage per iterator. Legitimate CDT usage passes 0 or 8 bytes, far below the cap.

Capacity

No contract that worked pre-split gets a new error. Some that exhausted the shared 1024-slot pool mid-mixed use now succeed (primary+secondary sum up to 2048).

Host ABI / chainbase

No change. Host intrinsic signatures, kv_object/kv_index_object layout, and serialization are all untouched.