fix(underlay): malformed DWF and DGN files no longer crash or hang the reader

- W2D: a stream cut off right after an extended opcode's '(' sliced its
  body backwards and panicked.
- DGN V8: the compound-file header was indexed before its length was
  known (a short file with the signature panicked), the sector shift was
  taken on trust (0 or 1 underflowed `sector / 4 - 1` into an endless
  loop), and the DIFAT chain count was unbounded. The header must now be
  complete, the shift 9 or 12, and the chain no longer than the file.

Found fuzzing the #1514 readers with truncated and random input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scene/model/underlay_vector/dwf.rs

@@ -270,7 +270,9 @@ mod w2d {
                     _ => {}
                 }
             }
-            let body = &self.b[start + 1..self.i.saturating_sub(1)];
+            // A stream cut off right after its '(' has no body at all.
+            let end = self.i.saturating_sub(1).max(start + 1);
+            let body = self.b.get(start + 1..end)?;
             let name_len = body.iter().position(|c| c.is_ascii_whitespace() || *c == b'(').unwrap_or(body.len());
             Some((String::from_utf8_lossy(&body[..name_len]).to_string(), &body[name_len..]))
         }