ICE: `--import-asm-json` does not range-check sub-assembly ids

## Description

triggers a compiler crash/assertion on valid IR.

### Root-cause analysis

`Assembly::createAssemblyItemFromJSON` (`libevmasm/Assembly.cpp`) validates the **tag id** of imported tag/tag-reference items (`requireTagIDInRange`, added by `72cdc01d3`) but never validates the **sub-assembly id**:

- For `PUSH [tag]` the value packs `subId` above `tagId`; the fix range-checks only `splitForeignPushTag().second` (the tag id) and, per its own comment, leaves the sub id (`.first`) unchecked. At assemble time it hits `solAssert(subId.value < m_subs.size(), "Invalid sub id")` (`Assembly.cpp:1065`).
- For `PUSH [$]` / `PUSH #[$]` the imported sub-object id is stored directly and never checked; it flows into `Assembly::decodeSubPath` whose `assertThrow(..., AssemblyException, "")` (`Assembly.cpp:1303`) fires when `subId >= m_subs.size()` and no matching sub path exists.

The importer already has the right idiom for this: `solRequire(..., AssemblyImportException, ...)`, which produces a clean `Error: Assembly Import Error: ...` and exit 1 (see the tag-id case).

## Environment

- Compiler version: Version: 0.8.37-develop.2026.7.31+commit.510b2a15.Linux.g++
- Operating system: Linux

## Steps to Reproduce

```sh
$ cat repro.json
{".code":[{"name":"PUSH [tag]","value":"36893488147419103233"},{"name":"JUMP"}]}
$ solc --experimental --import-asm-json repro.json
Internal compiler error:
/solidity/libevmasm/Assembly.cpp(1065): Throw in function const solidity::evmasm::LinkerObject& solidity::evmasm::Assembly::assembleLegacy() const
Dynamic exception type: boost::wrapexcept
std::exception::what: Invalid sub id
[solidity::util::tag_comment*] = Invalid sub id
```

```sh
$ cat repro.json
{".code":[{"name":"PUSH [$]","value":"0000000000000000000000000000000000000000000000000000000000000001"},{"name":"STOP"}]}
$ solc --experimental --import-asm-json repro.json
Uncaught exception:
/solidity/libevmasm/Assembly.cpp(1303): Throw in function std::vector solidity::evmasm::Assembly::decodeSubPath(solidity::evmasm::SubAssemblyID) const
Dynamic exception type: boost::wrapexcept
std::exception::what: Assertion failed
[solidity::util::tag_comment*] = Assertion failed
```