Unsigned occupancy subtraction needs int cast to clamp negatives

In SystemVerilog, subtracting an unsigned occupancy (OCC_W-bit logic) from a limit can wrap to a huge value instead of going negative, so a clamp-to-zero check never fires. Cast both operands with int'(...) before subtracting, then clamp below 0 and above NUM_PORTS. Verify with a test where occupancy exceeds the limit.