format: no truncating u64 -> usize casts

Every `u64 as usize` cast in clawhdf5-format (115 on wasm32) now goes
through addr::to_usize for values read from the file — addresses, lengths,
counts, dimensions: FormatError::Overflow where the value does not fit
instead of wrapping onto another part of the file on a 32-bit target — or
addr::saturating_usize for counts bounded by something in memory (codec
progress counters, writer sizes), which fail a bounds check or allocation
rather than wrap. A chunk whose offset does not fit lies outside the
dataset and is skipped; partial reads treat such an offset as out of the
buffers. On 64-bit targets nothing changes.

scripts/check-32bit-casts.sh (run by ci-test.sh) lints the wasm32 build
with clippy's cast_possible_truncation and fails on any u64 -> usize
finding; before this commit it listed 115.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-format/src/btree_v2_write.rs

@@ -6,6 +6,7 @@
 //! libhdf5 uses (`H5B2__hdr_init`) and the reader decodes pointers with, so
 //! the pointer widths the writer encodes are the ones every reader expects.
 
+use crate::addr::saturating_usize;
 #[cfg(not(feature = "std"))]
 use alloc::{format, vec, vec::Vec};
 
@@ -105,7 +106,9 @@ pub(crate) fn build_btree_v2(
         first_node: addr + hdr_len as u64,
         nodes: Vec::new(),
     };
-    let root = (n > 0).then(|| w.node(depth, 0, n as usize)).transpose()?;
+    let root = (n > 0)
+        .then(|| w.node(depth, 0, saturating_usize(n)))
+        .transpose()?;
 
     let mut out = Vec::with_capacity(hdr_len + w.nodes.len() * p.node_size as usize);
     out.extend_from_slice(b"BTHD");
@@ -201,7 +204,7 @@ impl TreeWriter<'_> {
                 "cannot spread {n} B-tree v2 records over {k} children at depth {depth}"
             )));
         }
-        let k = k as usize;
+        let k = saturating_usize(k);
         let in_children = n - (k - 1);
         let (base, extra) = (in_children / k, in_children % k);