fix: harden iterator MRU storage bounds

[sit-d]

Summary

• Harden IteratorMruLoadList so a corrupt on-disk count is clamped while still unsigned, before converting to int.
• Reject IteratorMruSaveList(..., count > 0, items == NULL) before the write path can pass a null data pointer to fwrite.

Verification

• Ad-hoc verification: /tmp/hermes-verify-iterator-mru-post-1b33tm6w.py asserted the new MRU load clamp, absence of the old cast-before-clamp sequence, the positive-count/null-items save guard, and the retained count > 0 write guard; it also ran git diff --check HEAD~1..HEAD. The verifier exited 0 and was removed.

Notes / limitations

• This is a small MRU-storage hardening change and does not overlap the currently open window-restore PRs (chore: ignore generated iterator artifacts #1/fix: restore only visible iterator windows #2).
• Full Windows iterator_gdi.cmd build/runtime verification was not run from this Linux cron environment because the required Windows SDK/User32/GDI toolchain is unavailable.

[sit-d]

Fresh post-guard ad-hoc verification for the current PR state:

• /tmp/hermes-verify-iterator-mru-guard-dfirrmm4.py asserted that IteratorMruLoadList clamps the unsigned header count before converting to int, the old cast-before-clamp sequence is absent, IteratorMruSaveList rejects count > 0 with items == NULL, and the fwrite path remains count-gated.
• The verifier also ran git diff --check HEAD~1..HEAD and confirmed the workspace was clean.
• Result: exited 0 and was removed.

Full Windows iterator_gdi.cmd build/runtime remains unrun in this Linux cron environment because the Windows SDK/User32/GDI toolchain is unavailable.

[sit-d]

Second fresh post-guard ad-hoc verification for the current PR state:

• /tmp/hermes-verify-iterator-mru-guard2-3dk4sm6b.py asserted the unsigned clamp-before-cast MRU header-count path, absence of the stale cast-before-clamp sequence, the positive-count/null-items save guard, and the retained count-gated fwrite path.
• The verifier also ran git diff --check HEAD~1..HEAD and confirmed git status --short was clean.
• Result: exited 0 and was removed.

Full Windows iterator_gdi.cmd build/runtime remains unrun in this Linux cron environment because the Windows SDK/User32/GDI toolchain is unavailable.