serialize 2.1.3: clean under the strict warning flags

Format 2.0, unchanged on the wire. A patch release: serialize.h is now clean under -Wconversion -Wsign-conversion -Wcast-qual -Wundef, so a consumer that builds with those flags as errors (framework does) compiles the header, and every serialize macro as it expands at the call site, without a warning.

• No API, wire, SerializeEnd or refusal behavior changes. Every conversion the header already did is now spelled as a cast. The macros assign the decoded temporary back to the caller's variable through a new internal helper, serialize::decoded(), which converts to whatever the destination is, bit fields included. It is not meant to be called directly.
• Machine code is unchanged. The same translation units built against 2.1.2 and 2.1.3 are instruction-identical (clang arm64 and x86_64, gcc 15 x86_64, apart from __LINE__ immediates in assertion calls), and so is the schema packet-wire harness object. Bench numbers from amd-3 are in #141: no change beyond noise.
• CI holds it. The strict warnings job builds a consumer translation unit and the embedded tests with the four flags as errors on clang and gcc, with a negative control.
• Tests and tooling, not part of the header: fuzz.cpp gains a hostile read with sentinel destinations (a refused scalar read leaves its destination unwritten and the stream terminal) and a negative control for every check, replayed under ctest without libFuzzer; tools/diff/diffgen.cpp and a nightly workflow hold every port's own runner to the reference's live verdicts on generated sequences. The sentinel pass found nothing in serialize.h.

STANDARD.md, IMPLEMENTING.md and the conformance corpus are unchanged from v2.1.1, so ports need not re-vendor. COMPATIBILITY pins stay at v2.1.1 (bd3d67e). yojimbo can re-vendor serialize.h as it stands.