fix(encode): assert virtual position bound in borrowed skip-path

prime_hash_table_for_range_borrowed stores virtual [dict][input]
positions with the same dict.region_len() base_offset as
start_matching_borrowed_dict, but lacked that path's u32-bound
validation. Add a debug_assert so test/direct-call misuse that
overflows u32 fails loudly at the source; production is already
gated by the frame compressor's borrowed_eligible check.

Author: polaz

zstd/src/encoding/simple/fast_matcher.rs

@@ -1306,6 +1306,12 @@ impl FastKernelMatcher {
         // match what the dual-base dict kernel reads from the main table; 0 when
         // no dict is attached.
         let base_offset = self.dict.region_len();
+        debug_assert!(
+            base_offset
+                .checked_add(block_end)
+                .is_some_and(|v| v <= u32::MAX as usize),
+            "virtual position overflow: dict.region_len()={base_offset} + block_end={block_end} exceeds u32",
+        );
         match self.hash_table.mls() {
             4 => self.prime_hash_table_impl::<4>(base, backfill_start, last_hashable, base_offset),
             5 => self.prime_hash_table_impl::<5>(base, backfill_start, last_hashable, base_offset),