fix(serder)!: guard version-string fixed widths and validate at every deserialize entry

[joeldsouzax]

Summary

Fixes three defects on the serder edge, found during the #79 research phase (write-up in #138). Each landed with a bug probe that fails while the defect exists.

1. VersionString::to_str() silently corrupted the 17-byte frame

{:x}/{:06x} rendering had no width guards: major/minor > 0xF or size > 0xFF_FFFF (16 MiB − 1) widened the version string past its documented 17 bytes, corrupting the frame instead of erroring. to_str() now returns Result and rejects overflow with the new SerderError::VersionStringOverflow variant.

2. Serializers never checked the size-field capacity (and misfiled the error)

All five event serializers could produce a corrupt frame for a > 16 MiB event, and mapped the u32 length-conversion failure into SerderError::DigestError — the wrong failure domain. Both fixed; an end-to-end probe serializes a 340k-anchor interaction event and asserts the typed error.

3. Per-ilk deserializers skipped version-string validation

Only deserialize_event called validate_version_string; the five per-ilk public entry points did not. Because SAID verification hashes the re-serialized compact form, whitespace-padded raw — valid JSON, intact SAID, length contradicting the version-string size — was accepted by deserialize_inception et al. Every public deserializer now validates first (probe: deserialize_*_rejects_length_mismatched_raw, red before the fix).

Breaking change (0.x minor bump)

• VersionString::to_str() → Result<String, SerderError>
• SerderError gains VersionStringOverflow { field, max }

Both intentional; per-ilk deserializers returning InvalidVersionString on inputs previously accepted is the bug fix itself.

Verification

• nix flake check green (pre-push hook, committed tree)
• Bug probes red-before/green-after: whitespace-padding probe confirmed failing pre-fix in-session
• Existing 175 serder/version tests unchanged and passing

Refs #79 (research: #138)

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 21 untouched benchmarks
⏩ 21 skipped benchmarks¹

---

_{Comparing fix/serder-version-string-guards (68cfc6b) with main (c435523)}

Footnotes

1. 21 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩