Question: How do we ensure `TDigest::merge` never causes numCentroids over centroidsCapacity and thus index out of bound?

https://github.com/apache/datasketches-java/blob/37edd8c9898f8f073aaafad7097cb0949eb84c85/src/main/java/org/apache/datasketches/tdigest/TDigestDouble.java#L571-L602

I don't find any constraint that `numCentroids` will never exceed `centroidsCapacity` here.

Start by reading TDigestDouble.java lines 571-602 and trace how merge updates numCentroids and uses centroidsCapacity. Determine whether the code establishes the required bound; done means documenting the invariant or identifying the precise change needed if it does not.

Written by the indexing model from the issue text.