fix(format): read version-1 shared message addresses after the heap offset

A version-1 shared message (HDF5 1.6) embeds the target as a symbol-table
entry: after six reserved bytes comes a length-sized local-heap offset,
then the object header address. We read the heap offset as the address,
so datasets using a committed datatype in 1.6-era files (tcompound.h5,
tcompound2.h5) failed with InvalidObjectHeaderVersion. parse_shared_ref
now takes length_size and skips the offset, as libhdf5 does.

Resolving a reference also no longer falls back to the first message of
any type in the target header: a missing target message is
SharedMessageTargetMissing instead of garbage.

Fixture: tcompound.h5 from libhdf5's tools/test/testfiles (8 KiB).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/known-issues.md

@@ -74,6 +74,9 @@ the VDS item, which is marked.
   - Hyperslab selection versions 1 and 2 are refused.
 - **Files with a user block:** the base address is not applied.
 - **Old-style shared messages (version 1)** read the wrong address.
+  **Fixed 2026-09-25:** the address follows a length-sized heap offset
+  (`tcompound.h5`, `tcompound2.h5`; their datasets now stop at the layout
+  v1 gap above).
 - **Array members of version-1 compound datatypes** (found while fixing the
   item above) were read as one element. **Fixed 2026-09-25.**
 - **Groups and links:**