FileSystemSpeechModelStore.bytesOnDisk adds file sizes with an addition that traps on overflow

## What happens

`FileSystemSpeechModelStore.bytesOnDisk` (`Sources/UttrflowSpeech/SpeechModelStore.swift:129-135`) sums file sizes with `total + Int64(size)`. Swift traps on integer overflow, so a filesystem that reports absurd sizes (a corrupt or network volume, or a sparse file) crashes the Diagnostics page and `uttrflow-dev models list` instead of reporting a large number.

This is not reachable with a real model on a healthy disk. It is worth fixing because the rest of this code already treats file attributes as untrusted input (a missing size is read as 0).

## How to check

Read lines 129-135. A test can't create files that large, so the sum needs to be reachable on its own (see below).

## Acceptance criteria

- The summing is moved into a small internal static function that takes the sizes, for example `static func total(of sizes: [Int]) -> Int64`, and `bytesOnDisk` calls it.
- It uses `addingReportingOverflow` (or equivalent) and saturates at `Int64.max` rather than trapping. A negative size is treated as 0.
- Tests cover an empty list, ordinary sizes, a negative size, and sizes whose sum overflows.

## Where to start

- `Sources/UttrflowSpeech/SpeechModelStore.swift:129-135`
- Tests to extend: `Tests/UttrflowSpeechTests/FileSystemSpeechModelStoreTests.swift`.
- Before pushing, run `make verify` (export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer first). It is the same command CI runs, and it enforces the 95% coverage floor per module.
- Read [CONTRIBUTING.md](https://github.com/uttrflow/uttrflow-swift/blob/main/CONTRIBUTING.md) first, and say on this issue that you are taking it.

**Size:** S, about 1-2 hours.

Read CONTRIBUTING.md first, then inspect Sources/UttrflowSpeech/SpeechModelStore.swift:129-135 and the related tests in Tests/UttrflowSpeechTests/FileSystemSpeechModelStoreTests.swift. Add coverage for empty, ordinary, negative, and overflowing sizes, and verify the result saturates instead of trapping. Run make verify with DEVELOPER_DIR set as described; done means the tests pass and CI's coverage requirement remains satisfied.

Written by the indexing model from the issue text.