[bfrancojr]

Fixes #132.

A schema or message that SBE's 16-bit header fields can't describe is now refused instead of being written with the wrong numbers. Before, (sbe.length) = 65537 bound as a 1-byte field. A block past 65535 bytes bound with wrapped offsets. A template id, schema id or version of 65537 was written as 1. A group of 65536 entries was written with a count of 0 and read back empty, with no error. Ported from protowire-go #254 (issue #250).

• BuildTemplate, BuildGroupTemplate and BuildCompositeFields add up offsets in int and check each field's end before narrowing, as Go's endOfField does. Every offset in a template is then in range.
• Codec::New refuses (sbe.template_id), (sbe.schema_id), (sbe.version) and (sbe.length) past 65535, with Go's text.
• Marshal refuses a repeated field with more than 65535 entries: sbe: field M.e has 65536 entries, past 65535, the largest numInGroup SBE can state.

Also fixed: every bind error of a template now has Go's text and prefix, such as sbe: field m.v1.M.s: string field requires (sbe.length) annotation (it was string/bytes field requires (sbe.length)). Go's bound errors carry that prefix, so matching them meant matching the rest. No test pinned the old texts.

Stack and merge order: #123 → #124 → #137 (#134) → this PR → #133's PR. Base: sbe-template-lookup-134. The two are independent in code, but both edit Codec::New and the CHANGELOG, so stacking avoids a conflict.

Evidence, at db81e1c, on macOS:

• ctest: 100% passed, 682 of 682, including SbeHeaderBounds.NewCodec (Go's 18 cases, each refusal paired with the same shape at 65535, which binds, round-trips, and whose header states the declared values) and SbeHeaderBounds.MarshalGroupCount (65535 entries round-trip; 65536 are refused).
• Mutation check: with the EndOfField and numInGroup checks disabled, both tests fail.
• scripts/go_differential.sh against protowire-go main 207fdfc: exit 1, from the same 450 PXF diff lines as at sbe: tell two schemas' template ids apart (#134) #137 (compared with cmp). Every section ran (18 SBE schemas converted alike, 362 documents), and no differing line mentions sbe. What remains is pxf: Marshal leaves out an unset (pxf.default) or (pxf.required) field, so it doesn't read back #129, pxf: FormatDocument drops every directive, so a @dataset document formats to nothing #130 and pxf: reject null on a (pxf.required) or @required field #131, each with its own PR.
• clang-format 18 --dry-run --Werror: clean.
• clang-tidy 23 on the three changed sources: the only hits are on lines this PR does not touch (LoadU16, WriteU16/32/64, the sbe: cut an overlong string on a character boundary #115 cut loop), which pass CI's tidy-18.

Not in this PR: Go also refuses a oneof field at bind time (sbe: oneof field M.f not supported), and this port doesn't. That changes behaviour, so it's filed separately rather than folded in here.

[bfrancojr]

Rebased onto main e1c1b72 (#136 merged); head is now 95517ac. The PR's own diff is unchanged, checked by comparing its added and removed lines before and after the rebase. Rebased as part of the SBE stack; evidence is on #123.

[bfrancojr]

Rebased with the stack onto main df6b102; head is now 43eabbe. Evidence is on #124.

[bfrancojr]

Rebased onto main 197e05b, after #124 and #137 merged as squashes: 43eabbe → 3486d29. The old #124 and #137 commits were dropped (git rebase --onto origin/main bcedc19), so this PR's own commit is the only one replayed. Its diff is unchanged, apart from where its CHANGELOG line lands. At the stack top (39e1261): build OK, ctest 100% tests passed out of 705. The remote head was read back with git ls-remote: 3486d29.