Fix crash: clamp model offset in ctrlOffsetAfterMove + findBefore/findAfter

[willwade]

Problem

Crash on DasherMac (macOS 26.5 hardened libc++): string::operator[] assertion fires when expanding a control node that tries to calculate a delete offset.

Stack trace

frame #4: string::operator[](this="aaaaaaaaaa.", __pos=75)     ← 11-char string, index 75
frame #5: findBefore(pos=75)                                    at CAPI.cpp:89
frame #6: getRange(buf="aaaaaaaaaa.", ...)                      at CAPI.cpp:134
frame #7: ctrlOffsetAfterMove(offsetBefore=76)                  at CAPI.cpp:400
frame #8: DeleteAction::calculateNewOffset(offsetBefore=75)     at ControlManager.cpp:193
frame #9: NodeTemplate::calculateNewOffset(offsetBefore=75)     at ControlManager.cpp:67
frame #10: CContNode::PopulateChildren()                        at ControlManager.cpp:94
frame #11: CDasherModel::ExpandNode()

Root cause

ctrlOffsetAfterMove uses the model's node offset (75) directly as an index into the edit buffer (11 chars). These diverge because control nodes have offsets in the model tree but produce no edit buffer characters — so the model offset can grow far beyond the buffer length.

Fix

Three layers of defence:

1. ctrlOffsetAfterMove: clamp offsetBefore to editBuffer.size() before passing to getRange
2. findBefore: clamp pos to s.size()-1 at entry (the function accesses s[pos])
3. findAfter: clamp pos to s.size() at entry (same defensive pattern)

8 insertions, 1 deletion. No API changes.