* refactor: simplify allocation tracker lifecycle

Use `_instance != nullptr` as the single source of truth for "tracking
active", dropping the separate `track_allocations` atomic and the lazy
`remaining_bytes_initialized` flag (TLS shrinks 48 -> 40 bytes). The
per-thread sampling offset is now applied once in `init_tl_state`
instead of on every first allocation.

- Make `_instance` a `std::atomic<AllocationTracker *>` with
acquire/release ordering and route all accesses through a
`get_instance()` helper so publishing and tearing down the instance
synchronize correctly with observing threads.
- Initialize the starter thread's TLS before publishing `_instance`
to avoid a window where other threads observe a non-null instance
with half-initialized state.
- Defer `pevent_munmap_event` to the next `allocation_tracking_init`
(guarded by `mapfd != -1`) so in-flight hooks cannot race with
teardown; add default initializers to `PEvent` to make the guard
sound.
- Call `restore_overrides()` in `allocation_profiling_stop` to pair
with `setup_overrides()` on start.

* docs: warn about restart races in public profiling API

Document that ddprof_stop_profiling() does not drain in-flight
allocation hooks, and that a stop/start sequence requires the caller
to quiesce allocation activity to avoid racing with ring buffer
re-init.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Erwan Viollet <[email protected]>
Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>