fix(collection,query): harden take/drop count-overflow family

[belowzeroff]

Follow-up to the review on #419 (whose INT64_MIN guard already landed via #409). That review found the guard stopped short of its own premise — sibling count paths kept the same signed-overflow UB, plus a pre-existing range-take overflow and a take/drop null-policy asymmetry. This PR closes all four, verified under UBSan against dev.

1. select take: INT64_MIN negation UB (query.c)

select … take: -9223372036854775808 fed the count through -atom_n / -n_take in the no-sort, apply_sort_take, and DAG tail-pushdown paths — signed-overflow UB (query.c:635/870/9941) that also cascaded into nrows - n in the TAIL kernel (exec.c:3022). These paths build the range themselves, so the ray_take_fn guard never saw them. Now each site rejects the null-sentinel count with a type error before the negation; the upstream guards also stop the exec.c cascade.

2. Range-take end = start + amount overflow (collection.c) — memory-unsafe

(take [1 2 3] [1 9223372036854775807]) overflowed end in the string / vector / dict / list branches → negative count → memcpy with a garbage size (crash / corruption on release; UBSan trap + oom on debug). The clamped end is now computed without ever forming an overflowing start + amount (min(amount, len - start)); the dict branch keeps its end < start guard since it doesn't early-return on start >= len.

3. take/drop null-sentinel asymmetry — unified

INT64_MIN is the i64 null sentinel (0N). (take xs 0N) erroring while (drop xs 0N) silently emptied was a footgun. Both verbs now reject it as a type error, matching ts_window_arg. (Updates the rfl test that pinned drop→empty.)

4. Guard cleanup (collection.c)

as_i64 on an -RAY_F32 atom bit-reads the storage, so an f32 count whose bits alias INT64_MIN would trip the guard with a misleading message — f32 is now rejected up front alongside f64. Dropped the redundant ray_is_atom check (is_numeric already implies an atom type code).

Testing

• make test — full suite green (3701/3702 pass, 1 pre-existing skip, 0 failed), ASan/UBSan clean.
• Coverage added: range-take overflow clamps and the unified type-error policy in collection/take.rfl and collection/drop_cut_rotate_cross.rfl; the three select take: paths (pushdown / sorted / grouped) plus valid negative takes in table/select.rfl.

Closes the review items from #419; #419 itself can be closed as superseded (its guard is already in dev via #409).