fix: prevent i32 overflow in array/string copy size calculations

[cs01]

Summary

• Fixes integer overflow when computing memcpy sizes for large arrays: mul i32 len, 8 overflows for arrays with >268M elements, causing wrong-sized copies and potential memory corruption
• Pattern: zext i32 to i64 first, then multiply in 64-bit — matches the correct pattern already used in numeric array push
• Fixed in 3 files: array mutators (string/object array push expand), string split allocation, promise.all/race result allocation

Test plan

• npm run verify:quick passes (tests + Stage 1 self-hosting)
• No behavioral change for normal-sized arrays — only prevents overflow for very large ones

🤖 Generated with Claude Code