PooledArrayBufferWriter accepts invalid advances and capacity overflow

[wallstop]

DISCLOSURE: LLM-GENERATED TEXT

Problem

PooledArrayBufferWriter.Advance accepts negative counts and counts beyond the granted buffer. This can move _written below zero or past the writable span. EnsureCapacity also treats a negative size hint as one, while unchecked addition and growth can overflow.

Acceptance criteria

• Reject invalid Advance counts without changing writer state.
• Reject negative size hints.
• Guard total capacity calculations and growth against overflow.
• Add boundary tests for negative, oversized, and overflow inputs.
• Keep normal serialization, pooling, typechecks, and allocation checks green.