refactor(swiflowui): funnel Double→Int crossings through one WasmSafeInt gate

[zzal]

Follow-up from the post-#251 swift-innovator review: collapse the two divergent wasm32-Int-trap guards into one home so the class can't recur via a new call site.

• New WasmSafeInt enum with exact(_:) -> Int? (nil outside signed-32-bit range, which also rejects NaN/±∞) and pixelClamp(_:) -> Int (non-negative floor, 32-bit ceiling).
• cssPixelInt and formatControlNumber keep their names/signatures (call sites and existing tests untouched) but now funnel through WasmSafeInt — a new Double→Int crossing has one obvious, tested helper to reach for instead of a hand-rolled Int(min(max(...))).
• Behavior refinement: formatControlNumber now integer-formats exactly Int32.min (representable, trap-free) where the old magnitude < 2^31 predicate fell it to the Double rendering.
• New WasmSafeIntTests pin both range ends, the just-past-either-end nils, NaN/∞, truncation, and the pixel clamp.

Note: the SwiflowDOM Int(exactly:) sites (DispatcherBridge, HMRBridge) are already correct and self-documented; this scopes to the two SwiflowUI helpers the review named (SwiflowDOM can't import SwiflowUI anyway).

Whole-package swift test: 1922 green.

🤖 Generated with Claude Code

[github-actions]

📦 Bundle size

Artifact	Baseline	This PR	Δ
App.wasm	5.06 MB	5.23 MB	+3.45%
App.wasm (gzip)	1.80 MB	1.87 MB	+3.56%
JS runtime	54.5 KB	54.5 KB	+0.00%
JS runtime (gzip)	11.3 KB	11.3 KB	+0.00%
Total (gzip)	1.81 MB	1.88 MB	+3.53%

✅ Within budget (≤5% growth allowed).

_{Baseline: Swift 6.3, WASM SDK 6.3-RELEASE, measured 2026-06-18.}