reject non-positive extents in load_npy and load_mat

[Nashit-h]

load_npy and load_mat build the output buffer straight from the extents in the file header without checking their sign, then read the payload with f.read_bytes(im->begin(), im->size_in_bytes()). A negative extent makes the computed end() fall short of the real end of the allocation, so size_in_bytes() reports more than was allocated and the payload read writes past the heap block; Buffer::check_overflow only catches this under assert, which is gone in a release build. load_tmp already validates header[0..3] > 0 for the same reason, so this applies that check in the two loaders that were missing it.

Reproducer: a .npy with 'shape': (2, -3) and a .mat with extents (4, -4), both built in the new test. On the unpatched tree, compiled -O2 -DNDEBUG -fsanitize=address, each gives a heap-buffer-overflow write at halide_image_io.h:1367 (npy) and :1861 (mat); the test aborts. With the fix both are rejected and the existing round-trip tests are unaffected.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@a624d06). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9221   +/-   ##
=======================================
  Coverage        ?   69.76%           
=======================================
  Files           ?      255           
  Lines           ?    78885           
  Branches        ?    18859           
=======================================
  Hits            ?    55038           
  Misses          ?    18266           
  Partials        ?     5581           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.