Use wrapping arithmetic in ProbeSeq::move_next to avoid overflow

[amitmishra11]

Bug

In ProbeSeq::move_next (src/raw.rs), stride and pos are updated with plain +=:

self.stride += Group::WIDTH;
self.pos += self.stride;
self.pos &= bucket_mask;

In a debug build this panics; in a release build it produces undefined behavior (integer overflow). Although the existing debug_assert! verifies that stride <= bucket_mask before the addition, it fires before the increment, so the assert itself does not rule out overflow once Group::WIDTH is added.

This was identified via Kani formal verification and confirmed as a bug by @Amanieu in #735.

Fix

Replace the plain additions with wrapping_add, which is what the subsequent & bucket_mask mask assumes:

self.stride = self.stride.wrapping_add(Group::WIDTH);
self.pos = self.pos.wrapping_add(self.stride) & bucket_mask;

The logic is otherwise identical; wrapping_add only differs from + when overflow would occur, and the final mask ensures pos stays in range regardless.

Verification

cargo check passes cleanly. cargo test cannot run on this machine due to an absent MSVC linker, but the type-level correctness of the change is confirmed by cargo check.

Closes #735

[clarfonthey]

It appears that the test failures are due to some unrelated lint changes; I can work on those in a separate PR, or someone else can get to that first. Otherwise, this PR looks fine and can be merged after that is fixed.

[amitmishra11]

Thanks for the review and for clarifying the CI failures. Happy to wait for those lint changes to land first, or rebase once they're merged if that helps.

[clarfonthey]

#738 is the fix; shouldn't need any changes from you once that merges.

[clarfonthey]

Trying to remember how to push changes to someone else's branch.