Fix integer overflow in heap_opt range walk on top-of-memory access (…

[kvpanch]

…#581)

The word-stepping loops in taint_range, mark_escaping_range, and mark_escaping_and_tainted_range walked a static range with while word < end { word += 32 }. When an access sits near the top of the address space, end = address.saturating_add(size) saturates at u64::MAX, and the final word += 32 steps past u64::MAX, panicking with "attempt to add with overflow".

Under --newyork this is reachable from valid Yul: folding add(mul(MAX_U256, 1), 0x41) to 0x40 lets an mstore corrupt the free-memory-pointer word with u64::MAX; mem_opt then forwards mload(0x40) to that literal, turning a later mstore(fmp, _) into a static unaligned store at u64::MAX that taints its covered words.

Iterate the already-bounded num_words count with a saturating step so the walk covers the same words without overflowing.