fix: use zext instead of sext for map/splice size calculations

[cs01]

Summary

• Replace sext i32 to i64 with zext i32 to i64 for size/capacity values in map and splice codegen
• sext on a large unsigned i32 (e.g., capacity after shl i32 cap, 1) sign-extends to a negative i64, causing massive or negative allocation sizes in GC_malloc
• Affected: 9 locations in map.ts (mapSize, capacity extensions), 4 in splice.ts (deleteCount, elemsAfter)
• Same class of bug as PR fix: prevent i32 overflow in array/string copy size calculations #268 (which fixed array/string copy size calculations)

Test plan

• npm run verify:quick passes (tests + Stage 1 self-hosting)

🤖 Generated with Claude Code