sourcemap: bit-packed InternalSourceMap (~2.4 B/mapping, no decode) - #29358

In `ParsedSourceMap.deinit()`, the `external_source_names` cleanup block (lines 113–117 of `src/sourcemap/ParsedSourceMap.zig`) lacks the `is_standalone_module_graph` guard that the adjacent `ism.deinit()` call correctly has. For standalone module graph PSMs, `external_source_names` elements are borrowed sub-slices of `serialized.bytes` (not heap-allocated), and the backing allocation is `alloc(?[]u8, source_files.len * 2)` while `external_source_names` only covers the first half — so if `deinit

When the `shift > 28` guard fires at line 255 of `readVarint()`, the loop breaks BEFORE executing `const byte = bytes[i]; i += 1;`, so `pos.* = i` points to the unread continuation byte (which always has MSB set, 0x80). The next `readVarint()` call starts from that byte and treats it as the start of a new multi-byte varint, silently misaligning all subsequent varint reads in that window stream. For valid data this path is unreachable (i32 fits in ≤5 bytes), but for a corrupted `RuntimeTranspiler

In `WindowReader.nextRare()`, after `readVarint(self.bytes, &p)` advances `p`, the code unconditionally accesses `self.bytes[p]` (line 378) without a bounds check. For corrupted blobs — a missing 0xFF terminator in the gen_line_exc section — `readVarint` can legally advance `p` to `bytes.len` (by consuming the 1-byte `stream_tail_pad`), making `self.bytes[bytes.len]` a one-past-end OOB read: a clean index-out-of-bounds panic in Debug/ReleaseSafe builds and silent undefined behavior in ReleaseFas