find_null_exn probes past the iobuf when a terminator is missing

Nobody has claimed this yet.

`Protocol.Shared.find_null_exn` checks `Iobuf.Peek.char iobuf ~pos` before checking whether `pos` is still inside the buffer. For an empty iobuf it peeks out of bounds immediately. For a non-empty iobuf without a null byte, it advances to `pos = length` and then peeks out of bounds before reaching its intended `failwith` branch.

This is reachable while parsing malformed backend messages containing C strings. The parser does reject the frame, but through an accidental bounds exception rather than the explicit missing-terminator error.

`Iobuf.Peek.index` already provides the bounded search needed here. I have a small patch ready that uses it and adds an inline regression for a missing terminator.

Start at Protocol.Shared.find_null_exn and compare its bounds handling with Iobuf.Peek.index. Check the inline regression mentioned in the issue, covering empty and missing-terminator buffers. Done means malformed C strings reach the explicit missing-terminator failure rather than an accidental bounds exception.

Written by the indexing model from the issue text.