Guard Buffer capacity growth against signed overflow in read_to_end

`std::fs::read_to_end` grows a full `Buffer` with:

`next_cap = dst_buffer.cap * 2`

before calling `buffer_reserve`.

Unlike the lower-level memory and buffer helpers, this multiplication is not checked for signed overflow.

For a valid capacity above `i64::MAX / 2`, doubling can wrap before the reserve request is made. The subsequent `next_cap < 4096` fallback can then turn the overflowed value into `4096`, which is smaller than the existing capacity and no longer represents a growth request.

The repository already has checked size arithmetic helpers and `buffer_reserve` performs its own capacity validation, so the caller should avoid overflowing before reaching those checks.

Code evidence:

- `std/fs/file.wave` — `read_to_end`
- `std/buffer/alloc.wave` — `buffer_reserve`
- `std/mem/ops.wave` — checked size arithmetic helpers

Acceptance:

- [ ] Replace unchecked capacity doubling with checked growth arithmetic.
- [ ] Return an existing appropriate negative error when the next capacity is not representable.
- [ ] Preserve the original buffer length on the failure path.
- [ ] Add a regression case that exercises the arithmetic boundary without requiring a giant real allocation.
- [ ] Keep normal 0 → 4096 and geometric growth behavior unchanged.

Start by reading std/fs/file.wave at read_to_end, then compare its capacity arithmetic with buffer_reserve in std/buffer/alloc.wave and the checked helpers in std/mem/ops.wave. Add a regression case for the signed-overflow boundary without a large allocation; done means an appropriate negative error preserves the original length while normal 0 → 4096 and geometric growth remain unchanged.

Written by the indexing model from the issue text.