fix: harden low-level codec boundaries

[chaokunyang]

Summary

• harden low-level buffer growth, cursor, copy, and native memory access boundaries across Java,
  C++, Python, Go, Rust, Swift, Dart, and JavaScript
• correct 36-bit string-header encoding at the six-byte boundary and guard oversized headers before
  they can drive unsafe reads or disproportionate growth
• preserve runtime-specific hot paths through owner-local unchecked operations only after capacity
  or range has already been proven
• document the JDK 25 VarHandle bounds owner and the MemoryAllocator successful-growth contract
• retain controlled temporal and native-carrier conversions without adding write-side depth checks

Validation

• affected runtime unit, formatting, lint, build, and integration suites pass
• Java 21 nine-module clean reactor passes
• Java 25 core multi-release build and overlay tests pass
• all affected-language serialization benchmark metrics are below the 1% regression threshold