refactor(uffs-mft): introduce Lcn(i64) newtype (Phase 4 sub-phase 5d, refs #191)

[githubrobbi]

Summary

Phase 4 sub-phase 5d — introduces a typed uffs_mft::platform::Lcn
newtype wrapping the raw i64 cluster identifiers that NTFS hands
back from FSCTL_GET_RETRIEVAL_POINTERS and $DATA mapping-pair
decode. All MFT-extent and data-run consumers now go through the
newtype, so the two distinct sparse conventions stop being
open-coded as raw integer comparisons at every call site.

What changes

New Lcn newtype (crates/uffs-mft/src/platform/lcn.rs)

• Copy + Eq + Ord + Hash + Display + Debug so it slots into
  HashMap / BTreeMap keys, comparisons, and tracing fields.
• Sentinels: Lcn::ZERO (data-run sparse: "no LCN offset emitted")
  and Lcn::HOLE = -1 (retrieval-pointer sparse: LCN_HOLE).
• Helpers: new, raw, raw_unsigned (documented bit-pattern
  reinterpret), is_hole (any negative — matches the historic
  lcn < 0 guard), is_zero (data-run sparse predicate).

Field migrations

• MftExtent.lcn: i64 → Lcn — byte_offset now branches on
  is_hole() and multiplies via raw_unsigned().
• DataRun.lcn: i64 → Lcn — is_sparse() checks is_zero(),
  byte_offset clamps any hole via is_hole() (defensive against
  corrupt buffers) and multiplies via raw_unsigned().
• parse_data_runs emits Lcn::ZERO for runs without an encoded
  offset and Lcn::new(current_lcn) otherwise — wire bytes
  unchanged.
• parse_retrieval_pointers wraps each decoded i64 LCN with
  Lcn::new at the FFI boundary — RETRIEVAL_POINTERS_BUFFER
  byte layout untouched.

Call-site migrations

io/extent_map.rs, io/chunking.rs, platform/upcase.rs,
platform/volume.rs, reader/{dataframe_read, dataframe_timing, index_read, index_timing, persistence, persistence_capture}.rs,
commands/windows/{benchmark_index, benchmark_mft, info}.rs,
ntfs/tests.rs.

Each callsite went from one of these patterns:

• lcn < 0 / lcn == 0 → lcn.is_hole() / lcn.is_zero()
• lcn.cast_unsigned() * bytes_per_cluster → lcn.raw_unsigned() * bytes_per_cluster
• lcn * bpc.cast_signed() → lcn.raw() * bpc.cast_signed()
• lcn: kernel_value.cast_signed() → lcn: Lcn::new(kernel_value.cast_signed())
• tracing lcn = ext.lcn → lcn = %ext.lcn so logs render 42
  not Lcn(42).

Wire format unchanged

Pinned by:

• platform::lcn::tests::raw_roundtrip_preserves_i64_exactly — any
  i64 survives Lcn::new → .raw() byte-identically.
• platform::lcn::tests::raw_unsigned_reinterprets_bit_pattern —
  raw_unsigned() matches i64::cast_unsigned() bit-for-bit,
  including the Lcn::new(-1).raw_unsigned() == u64::MAX corner.
• platform::extents::tests::byte_offset_returns_zero_for_sparse_extents
  / byte_offset_matches_lcn_times_bytes_per_cluster /
  byte_size_independent_of_lcn.
• ntfs::data_runs::tests::is_sparse_matches_only_zero_sentinel
  / byte_offset_clamps_holes_and_yields_lcn_times_bpc_otherwise /
  parse_data_runs_marks_sparse_runs_with_zero_lcn.

#[repr(C)] Win32 ABI mirrors and on-disk byte layouts are not
touched.

Untouched on purpose

VOLUME_DATA.mft_start_lcn: u64 (from
FSCTL_GET_NTFS_VOLUME_DATA) stays a raw u64 — it's the
unsigned-by-spec starting cluster of $MFT, not an LCN that can
carry a sparse marker. Consumers wrap it into Lcn at the
MftExtent construction boundary
(Lcn::new(mft_start_lcn.cast_signed())), so the type discipline
lives where extents are actually walked.

Verification

• ✅ just lint-pre-push (full local gate including
  lint-ci-windows) — 124s green.
• ✅ cargo xwin check --target x86_64-pc-windows-msvc --workspace --all-targets.
• ✅ cargo test --workspace --lib --bins — 163 lib tests pass
  (was 157 + 6 new Lcn / MftExtent / DataRun regression tests).

Refs #191