fix(cache): reject overflowing duration-less audio timestamps

[orut34iop]

Summary

Two increasing audio PTS values can still overflow signed subtraction when they straddle the Int64 range. The duration-less coverage path subtracts them before checking its gap bound, trapping the read-ahead worker. Reject the overflowing difference instead.

This branch also includes the independently reviewable prewarm repair from #831 as a prerequisite for reliable CI. Merge #831 first if preferred; the audio coverage change remains unchanged.

What changed

Use subtractingReportingOverflow before converting the delta to seconds or inserting coverage. The existing 0.5-second bound, positive-duration behavior, repeated TrueHD timestamps, and source-epoch cleanup are unchanged. This does not add a new coverage model or codec policy.

Initial audio-only validation

Host: Apple Silicon Mac17,3, macOS 26.7.1, Swift 6.4. Synthetic compressed-packet metadata through the real read-ahead worker and disk FIFO, with duration-less audio PTS Int64.min + 1 followed by Int64.max - 1. The producer must finish without a trap and must not invent audio coverage that permits a cached seek. Existing duration-less TrueHD, ordinary-duration and real-hole regressions run alongside it. No real codec decoding or device playback claimed.

• With the regression added to untouched upstream production code, the filtered test process exits with signal 5 (SIGTRAP). With the subtraction guard, the same test passes and rejects the cached seek.
• Native host build passed. All four audio-coverage regressions passed under LIBDISPATCH_COOPERATIVE_POOL_STRICT=1.
• Full default-traits run passed: 795 XCTest cases (one existing skip), 4,615 Swift Testing tests in 633 suites, zero failures.
• Test bundle and CLI were signed and verified with an Apple Development identity; linker ad-hoc signing was disabled.
• Documentation links and git diff --check passed; platform and all-traits coverage remain for upstream CI.

Checklist

• CHANGELOG updated; existing timing contract unchanged
• Conventional Commit
• Engine fix
• No public API or dependency changes

Combined-branch validation and CI repair

Merged the original #831 commit 71096dd61c1a9ab375d20b928ad9574d06c18ddf, preserving its ancestry. The only merge conflict was the changelog; both entries are retained. AVIOReader, prewarm tests and API documentation match #831 exactly; the original audio implementation and tests are unchanged. No API or dependency changes.

The previous macOS failure came from a fully adopted source issuing an unnecessary suffix request. This branch now contains the production fix and complete/partial-warm regressions instead of merely linking a separate PR. #831 remains open as the focused upstream contribution.

On the combined branch, the native host build and 64 prewarm/redirect/audio-coverage tests across 11 suites pass under the strict cooperative pool. Test bundle and CLI signatures were verified with a valid Apple Development certificate. Documentation links and diff checks pass. Full default/all-traits and platform CI has now passed against the new head (details below); the old failed run remains historical evidence. No device playback is claimed.

Final combined-head CI

All four checks passed at 240f3a6bf96b57b27b49a985ac52591ddebd7c24: macOS tests (default/all traits, normal/strict cooperative pool, standalone regressions and probes), tvOS/visionOS builds, iOS/release CLI builds, and documentation links. Successful run 39107380102. The original failed run is retained as history.