boost::format %N$ positional: signed-int overflow chain (UB)

We are filing this as hardening and not as a security advisory. This is one of two issues the Netskope Threat Labs team discovered and is reporting. They share no root cause with this report and can be triaged independently.

## Technical details

| | |
|---|---|
| **Component** | `boost/format/parsing.hpp:70-83,155-175,457-496` |
| **Upstream tested** | boostorg/format @ 3fb39d7d (develop HEAD) |
| **Class** | CWE-190 signed-int-overflow (UB only; no MC on real targets) |
| **Severity** | LOW — CVSS ~2.0 |
| **Reachability** | `boost::format(attacker_format_string)` |
---

## Root cause

Triple signed-int overflow on attacker digits. On 2's-complement: %2147483648$d -> n=INT_MIN -> argN_=INT_MAX -> num_args_=INT_MIN. Downstream guards prevent OOB; UBSan trap only.

## Trigger

boost::format("%2147483648$d")

## Upstream status

STILL PRESENT in boostorg/format develop HEAD and 1.85.0

## Suggested fix

Same `str2int()` clamp as SRC-11 closes this. Additionally, validate `argN_ < some_max` before using it as an index.

Start in boost/format/parsing.hpp at lines 70-83, 155-175, and 457-496, then compare the existing SRC-11 str2int() clamp. Exercise boost::format("%2147483648$d") under UBSan and verify the signed overflow is gone and argN_ is validated before indexing.

Written by the indexing model from the issue text.