format: add the Storage trait; make the error enums non-exhaustive

Range-read milestone M1, first step (docs/design/range-reads.md §3(a)):
a synchronous, no_std read interface with u64 offsets, read_at returning
Cow<[u8]>, read_ranges, len and an as_contiguous fast path. Implemented
for [u8], Vec<u8>, &T, Box<T> and Arc<T>; slices serve borrowed bytes.
read_exact_at reproduces the parsers' UnexpectedEof bounds error exactly,
so converted modules keep their error values.

FormatError gains Storage(String) and ContiguousStorageRequired; it and
the facade Error are now #[non_exhaustive] (breaking for exhaustive
matches, noted in the changelog; the Python bindings' match gets a
wildcard arm).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+### Range reads, milestone M1: the `Storage` trait (2026-09-26)
+- **Breaking: `clawhdf5_format::error::FormatError` and `clawhdf5::Error`
+  are now `#[non_exhaustive]`.** An exhaustive `match` on either needs a
+  wildcard arm. `FormatError` has two new variants: `Storage(String)` (a
+  storage backend failed to serve a read) and
+  `ContiguousStorageRequired(&'static str)` (an operation not yet converted
+  to range reads was asked of a backend without the whole file in memory).
+- New `clawhdf5_format::storage::Storage`, the synchronous, `no_std` read
+  interface of `docs/design/range-reads.md` option (a): `read_at(offset:
+  u64, len) -> Cow<[u8]>`, `read_ranges`, `len()` and an `as_contiguous()`
+  fast path; implemented for `[u8]`, `Vec<u8>`, and references, `Box`es
+  and (with `std`) `Arc`s of a `Storage`. Slices and `Vec`s serve borrowed
+  bytes, so parsing an in-memory file costs no copy.
+
 ### Chunked full reads (2026-09-26)
 - **Chunks are decoded straight into the output, into reused buffers.** A
   full read of a chunked dataset faulted in about three times its size in