SP: add bounds placeholders to message queues

Like all the annotations so far, leave these as CBArena-bounded.

However, we can start to do a little better than we were doing before: for
not-large deallocations, we know that the internal superslab pointer is
sufficiently authoritative that we can use it to get to data structures rather
than also passing an amplified pointer to the allocation in question.  This,
then, partially reverts some of the earlier changes made while plumbing
CapPtr<>s through the system.

While here, avoid quite as many void*-s in favor of Remote* or SlabNext*.

src/mem/remoteallocator.h

@@ -18,8 +18,8 @@ namespace snmalloc
     using alloc_id_t = size_t;
     union
     {
-      Remote* non_atomic_next;
-      std::atomic<Remote*> next{nullptr};
+      CapPtr<Remote, CBArena> non_atomic_next;
+      AtomicCapPtr<Remote, CBArena> next{nullptr};
     };
 
     /*
@@ -51,6 +51,15 @@ namespace snmalloc
     {
       return alloc_id_and_sizeclass & SIZECLASS_MASK;
     }
+
+    /** Zero out a Remote tracking structure, return pointer to object base */
+    template<capptr_bounds B>
+    SNMALLOC_FAST_PATH static CapPtr<void, B>
+    clear(CapPtr<Remote, B> self, sizeclass_t sizeclass)
+    {
+      pal_zero<Pal>(self, sizeof(Remote));
+      return remove_cache_friendly_offset(self, sizeclass);
+    }
   };
 
   static_assert(
@@ -62,7 +71,8 @@ namespace snmalloc
     using alloc_id_t = Remote::alloc_id_t;
     // Store the message queue on a separate cacheline. It is mutable data that
     // is read by other threads.
-    alignas(CACHELINE_SIZE) MPSCQ<Remote> message_queue;
+    alignas(CACHELINE_SIZE)
+      MPSCQ<Remote, CapPtrCBArena, AtomicCapPtrCBArena> message_queue;
 
     alloc_id_t trunc_id()
     {