fix CAR v1 validation gaps, fix readUvarint overflow, add 17 tests
CAR reader now validates version==1, requires non-empty roots, rejects
zero-length blocks, and enforces a 1 MiB per-block size limit (matching
atmos). Fix readUvarint where the overflow check was dead code — shift
was u6 (max 63) so the >= 64 check never triggered; replaced with a
bounded for(0..10) loop. Add 17 CAR tests covering header validation,
truncation, corruption, round-trip determinism, and size limits. Add 5
CAR benchmarks (read/write/round-trip with and without hash verification).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>