fix: guard string growth paths against size_t overflow

mk_capacity doubling, string_ensure_capacity's cap + sz + extra, and
lean_string_append's sz1 + sz2 (which may alias) can wrap on 32-bit
systems, producing undersized allocations followed by out-of-bounds
writes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed