`Buffer.subarray` clamps rather than throwing, so every declared structure in
the binary format was taken on trust. An overlong page swallowed the following
page's bytes and pushed the cursor past the end, dropping every cookie after
the boundary from an import that still reported success. A record whose
declared size overran its page left its string offsets free to read the next
record's bytes as this cookie's value.

Pages, records, and string offsets are now bounds-checked against what the file
actually contains, and a mismatch fails the read.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>