Use clamp-then-shrink for trust-box construction at variable bounds

[rjoomen]

This is a follow-up to #472, which fixed the trust box extending past variable bounds by sliding the full-width box inside [lb, ub] (the "slide always" policy). That fix kept the box well-formed, but preserving the full 2·box_size width let the QP step exceed box_size on the interior-facing side whenever a bound was active — breaking the trust-region invariant ‖p‖∞ ≤ box_size that the SQP merit-improve machinery relies on, even for iterates strictly inside their bounds (within a trust-radius of a bound).

This PR replaces the slide-always policy with clamp-then-shrink: clamp the iterate into [lb, ub], then strict-shrink the box against the bounds.

$$x_i^{\text{eff}} = \mathrm{clamp}(x_i, l_i, u_i), \qquad \text{box}_i = [\max(x_i^{\text{eff}} - \Delta_i, l_i),\ \min(x_i^{\text{eff}} + \Delta_i, u_i)]$$

It keeps the bug-fix property from #472 (box stays well-formed at and beyond bounds) while restoring the trust-region invariant for in-bounds iterates.

Behavior

• In-bounds iterates: the clamp is a no-op and ‖p‖∞ ≤ box_size is restored — the contract the merit-improve ratio ρ depends on.
• Near a bound: the box width shrinks monotonically from 2Δ (centered) to Δ (at the bound), instead of keeping the full 2Δ width (as under Fix bounds problem #472's slide-always policy) and allowing an in-bounds step that exceeds the trust radius Δ on the interior-facing side.
• Iterate drifted outside [lb, ub] (failed step, bad warm-start, failed-solve recovery): the box still stays well-formed (non-empty, non-inverted), so the QP solver does not error out.

Scope

Applied consistently to both QP-problem variants (IfoptQPProblem, TrajOptQPProblem) and the trajopt_sco optimizer.

Testing

New unit test trust_box_floor_unit covers the in-bounds invariant, the near-bound ramp, the at-bound floor, and the outside-bounds well-formedness across all three code paths.