docs(encoded_s2shape_index): state the trusted-input assumption on Init

[sushant-me]

Documents the assumption raised in #674, rather than changing behaviour.

EncodedS2ShapeIndex::Init returns true after reading only what it needs to begin decoding, so a malformed encoding is not discovered until the cell holding it is reached. The header said nothing about that, which leaves a reader unable to tell an out-of-contract input from an unhandled one — which is the reason #674, #676, #677, #678 and #679 all read as bugs against Init when the real issue is the contract it operates under.

The wording follows encoded_s2point_vector.h, which already documents this for its own Init:

Encoded types do not necessarily read all of their data when calling Init() … encoded types may in general log DFATAL errors when reading from an untrusted byte stream using unchecked accessors. … A true return status does -not- mean that the byte stream is without errors.

Applied to this class, and with the failure mode named, because it is not a clean error. Verified in the tree rather than inferred from the reports:

• encoded_s2shape_index.cc:79 — if (!cell->Decode(num_shape_ids(), &decoder)) { return nullptr; }
• encoded_s2shape_index.h:328 — Iterator::cell() is return *index_->GetCell(cell_pos_); with only ABSL_DCHECK(!done())

So a cell that fails to decode leaves GetCell() null and Iterator::cell() dereferences it. The note says so plainly, and says what a caller must do instead — validate the stream before Init(). It does not add a runtime check, and it does not change the return contract of Init().

Comment-only: 12 lines added to one file, no code touched.