fix(includes): ASan 集成支持 + 越界写封堵 + TypePrint 类型名截断 40→255

1. Phase2Translator 增加 TPC_ASAN 支持(opt asan 插桩+链接 -fsanitize=address)，配合 clang64 定位 0xbe 崩溃。2. llvmlite/memhub/viperio/viperlib 多处理无界 strcpy/strcat/下溢/递归守卫/栈数组钳制。3. memhub alloc 块尾 canary(MEMBUDDY_CANARY)+check_alive_blocks 校验+chk_stack realloc 扩容。4. TypePrint Ptr(Struct) 类型名截断上限 40→255：含 sha1 前缀类型名(如 bbdf3bbd4c3bc28c.CONSOLE_SCREEN_BUFFER_INFO=42)被截断产生未定义类型引用(llc undefined type)。

includes/llvmlite/__function.vp

@@ -489,24 +489,27 @@ def _replace_ssa_numbers(text: t.CChar | t.CPtr,
             nxt: t.CChar | t.CPtr = src_p + 1
             if nxt is not None and _is_digit_ch(nxt[0]) != 0:
                 num: t.CInt = string.atoi(nxt)
-                new_num: t.CInt = _map_get_i32(map_arr, num)
-                if num >= 0 and num <= max_n and new_num != -1:
-                    # 写入 '%'
-                    new_buf[dst_idx] = '%'
-                    dst_idx += 1
-                    # 写入新编号
-                    num_buf[0] = '\0'
-                    viperlib.snprintf(num_buf, 16, "%d", new_num)
-                    k: t.CSizeT = 0
-                    while num_buf[k] != '\0' and dst_idx + 1 < new_size:
-                        new_buf[dst_idx] = num_buf[k]
+                # 先做范围检查再读 map_arr：num 超 max_n 时 map_arr 只有
+                # (max_n+1)*4 字节，先读后查会越界读远端内存
+                if num >= 0 and num <= max_n:
+                    new_num: t.CInt = _map_get_i32(map_arr, num)
+                    if new_num != -1:
+                        # 写入 '%'
+                        new_buf[dst_idx] = '%'
                         dst_idx += 1
-                        k += 1
-                    # 跳过旧数字字符
-                    src_p = src_p + 1
-                    while src_p is not None and _is_digit_ch(src_p[0]) != 0:
+                        # 写入新编号
+                        num_buf[0] = '\0'
+                        viperlib.snprintf(num_buf, 16, "%d", new_num)
+                        k: t.CSizeT = 0
+                        while num_buf[k] != '\0' and dst_idx + 1 < new_size:
+                            new_buf[dst_idx] = num_buf[k]
+                            dst_idx += 1
+                            k += 1
+                        # 跳过旧数字字符
                         src_p = src_p + 1
-                    continue
+                        while src_p is not None and _is_digit_ch(src_p[0]) != 0:
+                            src_p = src_p + 1
+                        continue
         # 普通字符：直接复制
         new_buf[dst_idx] = src_p[0]
         dst_idx += 1
@@ -713,6 +716,10 @@ def _append_cstr(dst: t.CChar | t.CPtr, dst_size: t.CSizeT, src: t.CChar | t.CPt
     """将 C 字符串 src 追加到 dst 末尾"""
     if dst is None or src is None: return
     dlen: t.CSizeT = string.strlen(dst)
+    # 无符号下溢防护：dlen 超过缓冲大小时（缓冲已被破坏/悬空）直接返回，
+    # 否则 remain = dst_size - dlen 下溢成巨值会把 dst[dlen+i] 写穿到缓冲外
+    if dlen >= dst_size:
+        return
     slen: t.CSizeT = string.strlen(src)
     remain: t.CSizeT = dst_size - dlen
     if remain <= 0: return