fix: clamp saturated CSI cursor-move counts before the add (int overflow)

[pocketprobe]

Fixes an int-overflow class in the relative CSI cursor-move handlers: a saturated CSI count (parseArgument caps at Integer.MAX_VALUE) was added to terminal.x/terminal.y before setClampedCursorPos clamped the result, so the int addition wrapped negative and the clamp landed the cursor on 0 (the near edge) instead of the far edge. Same root cause as the SU/SD freeze (§36 Б2, fixed by clamping in CH8/CH9), but a correctness misposition rather than a DoS.

What this does

• New Terminal.moveCursorBy(dx, dy) bounds the delta to ±screen extent before the add; setClampedCursorPos still applies the screen + scroll-region clamp to the result, so scroll-region behavior is unchanged (traced scrollFirst=5/scrollLast=10: from y=8 a saturated down-move now hits scrollLast=10, where it hit scrollFirst=5 before). setClampedCursorPos can't be the clamp site — it takes an absolute target, not a delta, so the overflow has already happened before it runs.
• CUD (B), CUF (C), VPR (e), HPR (a) — the additive movers — now go through moveCursorBy. VPR/HPR are new in PR fix: missing CSI cursor escapes + unify cursor save/restore (SavedCursor) #24 and had inherited the bug.
• CUU (A), CUB (D) — routed through moveCursorBy for uniformity. They subtract, so they never overflowed; verified bit-identical for in-range args and equivalent for huge args (both clamp to the near edge). This is the only non-buggy code touched, kept so all four cardinal directions share the one primitive.
• CNL (E) — stays per-handler: it resets the column to 0, which a delta-preserving move can't express; inline Math.clamp on the row delta. CPL (F) is untouched (subtraction + column reset; safe).
• setRelativeCursorPos under DECOM — a separate overflow the hunt surfaced in the same pass: it did scrollFirst + y with the raw arg, and CUP/HVP/VPA feed the row here, so a saturated row overflowed scrollFirst + MAX_VALUE negative and clamped to scrollFirst (top) instead of scrollLast (bottom). Now bounds y to [0, scrollLast - scrollFirst] before the add, preserving origin-relative semantics (row 1 = scrollFirst). Distinct from §36 m1 / §37 Б6 — the saved-cursor-after-width-change AIOOBE that PR fix: missing CSI cursor escapes + unify cursor save/restore (SavedCursor) #24's SavedCursor refactor already resolved.

Verification

• 9 new tests in TerminalBufferTest, 100/0. Six revert-and-fail (CUD/CUF/VPR/HPR/CNL/DECOM) feed CSI 2147483647 from a non-zero start and assert the far edge, not 0; CUU/CUB are behavior-preservation for the routing; moveCursorBySaturatedDownInScrollRegionClampsToScrollLast covers the scroll-region case (saturated down-move from inside a region lands on scrollLast, exercising the two-stage delta-then-region clamp). Each pairs a normal small move with the saturated one so the pre-fix path is exercised before the overflow path.
• Full test suite green (./gradlew test).
• Verified against upstream/work (760bc44): the three + args[0] sites PR fix: missing CSI cursor escapes + unify cursor save/restore (SavedCursor) #24 added (VPR/HPR/CNL) were the inherited regressions; the two pre-existing ones (CUD/CUF) predate fix: missing CSI cursor escapes + unify cursor save/restore (SavedCursor) #24.

QA gate

• Checkstyle 0, PMD 0 in touched files. The 5 checkstyle-main errors and 41 pmd-main warnings are pre-existing in unrelated files (inet session imports, TunnelManager).
• SpotBugs delta 0 — no BugInstance at moveCursorBy/setRelativeCursorPos; the primitive takes primitives and calls existing methods, adding no EI_EXPOSE_REP2/MS_*/PA_* findings.

Notes for review

• The judgment call is routing CUU/CUB through moveCursorBy when they don't strictly need the fix — it's a uniformity win (all four cardinal directions share one bounded primitive, so a future handler can't forget the clamp) at the cost of touching two files that weren't broken. Happy to pull them back if you'd rather keep this to the five broken handlers only.

Next

• A dead-code pass is due soon: §36 m11 (Utf8Decoder.hasActiveSequence 0 refs, TerminalIO.putOutput(byte), Terminal.getTerminalWidth() tests-only, the never-called incrementLastLineToDisplay(true) branch, TerminalRenderer.findLineIndex/isPrintableCharacter → private, ImplementedPrivateModes.modeStatus public-mutable → private) plus §37's ColorUtils, RunnableUtils.doNothing, SessionOperator. Separate PR.

Assisted by: GLM (syn:large:text on synthetic.new) — code generation and review.