fix: prevent integer overflow and OOB reads in WASM safety checks

[hobostay]

Summary

Four safety bugs found and fixed in the WASM compression pipeline:

1. Integer overflow in tq_dot_batch (wasm_exports.zig): num_vectors * bytes_per_vector could wrap u32, creating an undersized slice and causing out-of-bounds reads in the dotBatch loop. Fixed with std.math.mul overflow check.

2. Integer overflow in format.slicePayload (format.zig): polar_bytes + qjl_bytes could wrap u32, making payload_end smaller than actual payload, bypassing the bounds check. Fixed with std.math.add overflow check.

3. Missing payload size validation (turboquant.zig): decode() and dot() validated header dimension but not that polar_bytes/qjl_bytes were consistent with that dimension. A crafted compressed buffer with correct dim but undersized payload fields would cause out-of-bounds reads in polar/qjl functions. Added validatePayloadSizes() to check expected sizes before use.

4. Dead code in dotBatch (turboquant.zig): comptime if (is_aarch64) 4 else 4 always evaluates to 4 — both branches are identical. Replaced with std.simd.suggestVectorLength for consistency with other modules, and removed the unused builtin import.

Test plan

• All existing tests pass (zig build test)
• New test: decode rejects payload with inconsistent field sizes — verifies decode rejects corrupted polar_bytes
• New test: dot returns zero on payload with inconsistent field sizes — verifies dot returns 0 on corrupted payload
• Manual test: tq_dot_batch with large num_vectors * bytes_per_vector that overflows u32 should return silently

🤖 Generated with Claude Code

[teamchong]

Thanks for catching these, the four fixes are all real and still applicable on current main.

Three small asks:

1. Rebase on main — PR feat: TQ-compressed KV cache for browser LLM (WebGPU) #7 just landed and touched the same lines in decodeInto / dot:
2. One-line conflict in src/turboquant.zig around decodeInto (same pattern in dot)
3. Format check — there's an extra blank line before the closing }; of Engine at line 246. zig fmt src/ will fix it. CI is failing on format check right now, and this is the only thing it catches.

If it'd be easier, toggle "Allow edits from maintainers" on the PR and I'll push the rebase for you. Otherwise happy to re-review as soon as CI flips green.

[hobostay]

Hi @teamchong, thanks for the quick review!

I've rebased on main (after #7), resolved the one-line conflict in decodeInto, and fixed the extra blank line before }; in Engine. All three items addressed:

1. Rebased on latest main — conflict in src/turboquant.zig resolved (kept the validatePayloadSizes check on top of the updated decodeInto/dot from feat: TQ-compressed KV cache for browser LLM (WebGPU) #7)
2. Format fix applied — removed the extra blank line before };
3. CI should pass on format check now

Ready for re-review whenever you have a moment.