add BALLOC.init_nofree
add BALLOC.init_nofree

initialize the allocator with no free blocks.

The spec for [BALLOC.init] doesn't allow chaining [init] of two
allocators together, otherwise the postcondition would include
all blocks twice in both reps.

The plan is to call [init] on bxp1 and [init_nofree] on bxp2,
then we [steal] all odd blocks from bxp1 and [free] them into bxp2.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl