format: no truncating u64 -> usize casts in gather_storage and ExtentBytes

check-32bit-casts.sh flagged two casts added by the previous commits; both
values are bounded (checked by gather_storage's first walk, and built from
a usize fetch length), so they go through addr::saturating_usize.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-format/src/gather.rs

@@ -454,9 +454,9 @@ pub(crate) fn gather_storage<S: Storage + ?Sized>(
         if error.is_some() {
             return;
         }
-        // Checked by the first walk.
-        let mut at = first as usize * elem_size;
-        let mut len = n as usize * elem_size;
+        // Checked by the first walk (these cannot saturate or wrap).
+        let mut at = crate::addr::saturating_usize(first).wrapping_mul(elem_size);
+        let mut len = crate::addr::saturating_usize(n).wrapping_mul(elem_size);
         while len > 0 {
             while spans.get(span).is_some_and(|s| s.out_end <= out.len()) {
                 span += 1;

crates/clawhdf5-format/src/storage.rs

@@ -477,7 +477,8 @@ impl<'a> ExtentBytes<'a> {
                 ));
             }
             for ((slot, bytes), r) in slots.into_iter().zip(got).zip(&ranges) {
-                out[slot] = Extent::Bytes(exact_len(bytes, (r.end - r.start) as usize)?);
+                let len = crate::addr::saturating_usize(r.end - r.start);
+                out[slot] = Extent::Bytes(exact_len(bytes, len)?);
             }
         }
         Ok(ExtentBytes::Fetched { base, extents: out })