Decoder round-trip benchmarks can PASS corrupted files: check every decode result and re-verify the header count and hash

A codec benchmark loaded each test file by decoding all blocks into a reference stream, re-encoded it, then compared. Two bugs let corrupted inputs pass: (1) the loader and the round-trip checker ignored the decoder's bool result. When the validating decoder rejected a block it left zero-initialised output, which was appended to the reference stream, re-encoded identically, and reported PASS with exit 0. (2) Nothing checked the loaded stream against the file's own header. Fix: treat any false from decodeBlock as a load failure (and the bench exits nonzero on any load failure); after loading, require decoded count == header count, payload size == count × value width, and a recomputed stream hash == header hash. Test it with a truncated file (drop the last 40 bytes): it must exit 1. Related hardening for the decoder itself: give varint decoding an end pointer and reject unterminated LEB128 and a 10th byte that overflows u64 (a ten-byte cap alone is not enough); check bounds by subtraction (csize > size - off) rather than off + csize, which can wrap; validate counts before allocating.