format: no truncating u64 -> usize casts

Every `u64 as usize` cast in clawhdf5-format (115 on wasm32) now goes
through addr::to_usize for values read from the file — addresses, lengths,
counts, dimensions: FormatError::Overflow where the value does not fit
instead of wrapping onto another part of the file on a 32-bit target — or
addr::saturating_usize for counts bounded by something in memory (codec
progress counters, writer sizes), which fail a bounds check or allocation
rather than wrap. A chunk whose offset does not fit lies outside the
dataset and is skipped; partial reads treat such an offset as out of the
buffers. On 64-bit targets nothing changes.

scripts/check-32bit-casts.sh (run by ci-test.sh) lints the wasm32 build
with clippy's cast_possible_truncation and fails on any u64 -> usize
finding; before this commit it listed 115.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-format/src/group_v1.rs

@@ -3,6 +3,7 @@
 #[cfg(not(feature = "std"))]
 use alloc::{string::String, vec::Vec};
 
+use crate::addr::to_usize;
 use crate::btree_v1::collect_symbol_table_nodes;
 use crate::error::FormatError;
 use crate::local_heap::LocalHeap;
@@ -54,7 +55,7 @@ pub(crate) fn v1_group_entries(
     // Parse local heap
     let heap = LocalHeap::parse(
         file_data,
-        sym_table_msg.local_heap_address as usize,
+        to_usize(sym_table_msg.local_heap_address)?,
         offset_size,
         length_size,
     )?;
@@ -70,7 +71,7 @@ pub(crate) fn v1_group_entries(
     let mut entries = Vec::new();
     let mut heap_checked = false;
     for snod_addr in snod_addrs {
-        let snod = SymbolTableNode::parse(file_data, snod_addr as usize, offset_size)?;
+        let snod = SymbolTableNode::parse(file_data, to_usize(snod_addr)?, offset_size)?;
         for entry in &snod.entries {
             // Like libhdf5, look at the heap's free list only once a name is
             // needed: an empty group with a damaged heap still lists.
@@ -152,7 +153,7 @@ fn for_each_v1_soft_link(
 ) -> Result<(), FormatError> {
     let heap = LocalHeap::parse(
         file_data,
-        sym_table_msg.local_heap_address as usize,
+        to_usize(sym_table_msg.local_heap_address)?,
         offset_size,
         length_size,
     )?;
@@ -164,7 +165,7 @@ fn for_each_v1_soft_link(
     )?;
     let mut heap_checked = false;
     for snod_addr in snod_addrs {
-        let snod = SymbolTableNode::parse(file_data, snod_addr as usize, offset_size)?;
+        let snod = SymbolTableNode::parse(file_data, to_usize(snod_addr)?, offset_size)?;
         for entry in &snod.entries {
             if entry.cache_type != CACHE_TYPE_SOFT_LINK {
                 continue;
@@ -242,7 +243,7 @@ pub fn resolve_path(
                 // Not last — must be a group, parse its object header to get symbol table
                 let obj_header = ObjectHeader::parse(
                     file_data,
-                    entry.object_header_address as usize,
+                    to_usize(entry.object_header_address)?,
                     offset_size,
                     length_size,
                 )?;