fix(specializer): harden the interpreter against adversarial findings — TASK-42

Six agents (4 attack lenses + 2 reviews) probed the oracle; confirmed
findings fixed and pinned:

- StrRef offsets widened u32 -> usize: a single call legitimately exceeding
  4 GiB of varlen data silently aliased old spans (Ok with corrupt output —
  the one thing an oracle must never do)
- store.opt with a false flag now stores the type-default payload the spec
  pins, not the live register
- check_input validates the validity lane of nullable columns (a short
  valid vec silently meant "all valid")
- register slots assigned densely at compile: sparse-but-legal value ids
  can no longer inflate the frame (Value(u32::MAX) demanded a 64 GiB vec)
- zero-allocation claim restated honestly: warmth is per content profile
  (branch paths, probe hits, non-NULL varlen), growth one-time + monotone —
  refuted-as-written by branch/probe/validity flips at identical shape
- RunState.emitted reports the row count (observable with 0 out columns)
- Ctx made private; out_decl drops its unread nullable flag; probe hit arm
  zips entry values directly
- semantics pins now all tested: overflow/div traps incl. irem MIN%-1, fcmp
  NaN table, ftoi ties + range traps, IEEE inf/nan flow, scmp order, exact
  stoi parse, load.opt garbage normalization

cargo 65 passed; gate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ahrzb