[mcollina]

Reject parse ranges that cannot be represented by Milo's event format.

Event offsets and lengths are encoded as unsigned 32-bit values. Native callers could previously pass a range larger than 4 GiB and receive silently wrapped callback coordinates.

On 64-bit native targets, Milo now rejects either a current input or a managed retained/current aggregate above u32::MAX with the appended ERROR_INPUT_TOO_LARGE code before accessing the unrepresentable data. Error callbacks retain normal parse() delivery. Event writers use checked conversions, so no coordinate is silently narrowed.

A native regression uses inaccessible synthetic ranges to prove both rejection paths run before pointer access and verifies one on_error callback per call. Documentation records the native limit and WebAssembly's naturally 32-bit coordinates.

The full Rust/fuzz, C++ reference, and 98-test WASM suites pass; Rust references and independent review also pass.

This fixes SEC-14 from #38.