fix(cpp): preserve full-size tablet allocations and report OOM

[ColinLeeo]

NewTablet(..., 1 << 29) could corrupt native memory because mem_alloc accepted a uint32_t byte count while Tablet initialization used the full size_t buffer size. String preallocation also multiplied the row count in 32-bit arithmetic, and allocation failures could leave partially initialized buffers unsafe to release.

Use size_t throughout the allocator and string-buffer capacity, and preserve the full maxRows * 32 string preallocation. Valid row capacities attempt normal allocation; failures propagate as OOM without an artificial row or preallocation cap. Keep byte counts intact in allocation metadata and memory accounting, and check size arithmetic before it can wrap. Propagate string and bitmap allocation failures and safely clean up partial initialization.

Use unsigned row indices and device-segment boundaries consistently, fix bitmap and offset-array size arithmetic, and let the Go bridge accept the C ABI's positive uint32_t row-count range. Actual string data still has to fit the existing signed Arrow offsets.

Regression tests use injected allocation failures to verify complete requests at and above 4 GiB without allocating those buffers. They cover all supported Tablet types, every native constructor, C API OOM propagation, 32-byte-per-row string preallocation, 15 partial-initialization failure positions with balanced memory accounting, and filling and checking 2^20 rows of DOUBLE, TEXT, BLOB, and STRING data.

Validation on macOS arm64:

• Complete enabled C++ suite: 876 passed, 3 skipped for unavailable external fixtures, and 10 existing tests disabled.
• GOCACHE=/tmp/tsfile-go-build-cache go test -count=1 ./... passed.
• Spotless checks for every modified C++ file, Go formatting, and git diff --check passed.

ASan/UBSan validation remains unavailable on this host: the system sanitizer runtime hangs during initialization before main, and an alternative local runtime also fails during initialization. Sanitizer checks are not reported as passing.