serialize.c 1.9.1: the padded wrapper checks its destination in every build

serialize_read_stream_init_padded now checks in every build that the destination holds the payload plus eight bytes of slack and that the length is not negative; a destination that does not qualify yields a failed stream on which every read fails and writes nothing, instead of an over-read, and a checked build still asserts loudly. 1.9.0 tested the size only in an assert, which left the parameter unused in release builds and made a consumer compiling the header under -Werror refuse it. A new release-check target, part of make test, compiles the header under -DNDEBUG -Wall -Wextra -Wunused-parameter -Werror and runs the round-trip suite with assertions off, with a negative control that plants an unused parameter; that run also brought a NaN-clamp test block to life that no build had ever compiled. The wire is unchanged.