qmdb/sync/gaps: clamp checked_add to range.end instead of unwrap-panic

[SAY-5]

Fixes #2068.

Location::checked_add returns None on overflow OR when the result exceeds Family::MAX_LEAVES. The two callsites in gaps::find_next unconditionally .unwrap()'d the result, so fuzzer inputs with start_loc near the family ceiling panicked the sync engine.

Clamp to range.end on None so the merge loop terminates on the next iteration as expected, instead of crashing.

[danlaine]

I think this is cleaner with just the .unwrap_or changes.

Suggested change

	// `Location::checked_add` returns `None` on overflow *or* when the result
	// exceeds `Family::MAX_LEAVES`. The previous unconditional `.unwrap()`
	// panicked on fuzzer-generated inputs that placed `start_loc` near the
	// ceiling. Clamp such ranges to `range.end` instead — semantically the
	// batch is already at the boundary, so the merge logic terminates the
	// loop on the next iteration as expected (#2068).
	let range_end = range.end;

[SAY-5]

Agreed, I'll trim the diff to just the unwrap_or adjustments and push.

[SAY-5]

Pushed 9db797e, trimmed the diff to just the two .unwrap_or(range.end) replacements.