toArrayBuffer: Negative-offset semantics are confusing/probably wrong

Issue flagged by Trevor here: https://github.com/anza-xyz/kit/pull/1957#pullrequestreview-4982438072

> Negative-offset semantics are murky in the slow path. buffer.slice(bytesOffset, bytesOffset + bytesLength) with a negative bytesOffset produces an end index that crosses zero (e.g. slice(-1, 0) → empty buffer), so most negative offset/length combinations return empty buffers rather than tail slices. The existing it.each tests only assert not.toBe(buffer), so they don't catch this.

It seems like this is probably not behaving as we'd expect. Should probably try to make this behave exactly the same as native `slice` in this case.

Start at the toArrayBuffer implementation and its existing it.each tests, then compare the slow path's negative-offset behavior with native slice. Extend the tests to cover negative offset and length combinations, and consider the issue done when the helper returns the same results as native slice without weakening the existing buffer-identity assertions.

由索引模型根據 Issue 內容生成。