format: a chunk offset past usize writes nothing

Placing a chunk cast its u64 offsets to usize; on a 32-bit target an
offset past the address space wrapped into the output (and could then
overlap another chunk's region when chunks are placed concurrently).
Such an offset is past the dataset, so it now saturates and the chunk
writes nothing, as the concurrent-placement check already assumed. No
change on 64-bit targets, where the cast cannot wrap (so no test here).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-format/src/chunked_read.rs

@@ -155,7 +155,9 @@ impl ChunkPlacer {
             &mut long
         };
         for (o, &off) in chunk_offsets.iter_mut().zip(offsets) {
-            *o = off as usize;
+            // An offset past `usize` is past the dataset: the chunk writes
+            // nothing (a plain cast would wrap it into the output).
+            *o = usize::try_from(off).unwrap_or(usize::MAX);
         }
         // SAFETY: the caller's contract.
         unsafe {