Return fs errors for offset overflow and backend over-reporting

Resolver and built-in backend offset arithmetic currently contains unchecked or unwrap-based additions, and resolver code trusts backend byte counts. Define the intended error mapping, then replace overflow panics with typed fs errors and reject backends that report more bytes than the supplied buffer. Cover resolver, InMem, TarRo, and overlay copy paths. Deferred from #1318 to avoid changing established behavior during the refactor.

Start by tracing offset arithmetic and backend byte-count handling through the resolver, InMem, TarRo, and overlay copy paths. Define the intended typed fs-error mapping before replacing unchecked additions, then verify that over-reporting backends are rejected and overflow paths no longer panic.

Written by the indexing model from the issue text.