fix(af): bound the anti-forensic stripe count (third fuzz-found cost axis)

[h4x0r]

Why there was still a timeout

The nightly unlock fuzz target kept timing out after the PBKDF2 and Argon2
bounds landed, with a new artifact. Those bounds were necessary and not
sufficient — key derivation isn't the only cost the header chooses.

KeySlot::stripes is a u32 read straight from the header (be_u32 at offset
44 for LUKS1, the af.stripes JSON field for LUKS2) and nothing validated
it. It reached two unbounded places:

// volume.rs — the header sizes an allocation
let material_len = af::material_len(key_bytes, slot.stripes as usize);
let mut material = vec![0u8; material_len];

// af.rs — and the trip count of the merge loop
for i in 0..stripes.saturating_sub(1) { ... }

64 bytes × u32::MAX stripes is roughly 275 GB, requested on the
container's say-so.

The bound

MAX_STRIPES = 1 << 20. LUKS1 fixes the count at 4000 and cryptsetup writes the
same for LUKS2, so that's two orders of magnitude of headroom over anything
genuine.

Enforced in two places, because there are two ways in:

• material_len is now fallible — it computes a size the caller immediately
  allocates, so an implausible count is refused here rather than returned as an
  allocation request. The multiply is checked too: block_size * stripes can
  wrap, and a wrapped product means a small allocation followed by
  out-of-bounds reads — worse than a large one.
• merge validates independently — it's re-exported as the public
  af_merge, so it can't assume a caller came through material_len; its loop
  runs stripes - 1 times regardless of the material length.

The refusal names the count and the buffer size it would have produced, so an
examiner sees what the container asked for rather than a bare "invalid".

Third axis, same class

This is the third header-chosen cost in the unlock path: PBKDF2 iterations,
Argon2 time/memory, now AF stripes. I reported the earlier PR as fixing the DoS
when it had fixed two of three — the surviving fuzz timeout is what pointed
here.

Verification

• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test --workspace — 7 suites, 0 failures
• coverage gate — 0 uncovered lines
• a real 4000-stripe split still round-trips, so the bound doesn't reject
  genuine containers