fix(tpv): vpi 参数数上限哨兵 + declare 链遍历哨兵，定位 builtins.vp dump 卡死根因

dump 步数哨兵已定位卡死链路为 printf 的 Params 链异常。新增：
1. VpiReader _inject_function_declare/_inject_method_declare 参数数上限
   128（fail-fast）：vpi tree 深层节点被覆盖损坏时 args_list.__len__()
   返回垃圾大数 → add_param 海量次 → Params 链超长，dump 误报成环
2. CallGenBase._ensure_method_declare FuncHead/Params 遍历步数上限
   （防 translate 期间死循环）
3. dump 哨兵报错增强打印 Params.Count，区分真成环与海量节点

includes/llvmlite/__function.vp

@@ -687,7 +687,12 @@ def FunctionPrint(buf: t.CChar | t.CPtr, size: t.CSizeT,
     while cur is not None:
         cur_steps += 1
         if cur_steps > IR_DUMP_CHAIN_LIMIT:
-            stdio.printf("[IR-DUMP] 链表成环: func params（函数名=%s，print 终止）\n", func.Name)
+            if func.Params is not None:
+                stdio.printf("[IR-DUMP] 链表异常: func params（函数名=%s，Params.Count=%zu，遍历超 %d 步，print 终止）\n",
+                             func.Name, func.Params.Count, IR_DUMP_CHAIN_LIMIT)
+            else:
+                stdio.printf("[IR-DUMP] 链表异常: func params（函数名=%s，Params=None，遍历超 %d 步，print 终止）\n",
+                             func.Name, IR_DUMP_CHAIN_LIMIT)
             stdlib.exit(1)
         if first == 0:
             _append_cstr(buf, size, ", ")

includes/llvmlite/__module.vp

@@ -242,8 +242,8 @@ class LLVMModule:
                     while param_scan is not None:
                         param_scan_steps += 1
                         if param_scan_steps > IR_DUMP_CHAIN_LIMIT:
-                            stdio.printf("[IR-DUMP] 链表成环: func params（函数名=%s，dump 终止）\n",
-                                         func_scan.Name)
+                            stdio.printf("[IR-DUMP] 链表异常: func params（函数名=%s，Params.Count=%zu，遍历超 %d 步，终止）\n",
+                                         func_scan.Name, func_scan.Params.Count, IR_DUMP_CHAIN_LIMIT)
                             stdlib.exit(1)
                         if param_scan.Ty is not None:
                             self.ensure_opaque_for_type(pool, param_scan.Ty)