fix(store): rustdoc hygiene + u64-safe cursor clamping

- resolve or unlink 25 preexisting rustdoc warnings: broken
  intra-doc links (error variants), public-docs-linking-private-items
  (crate-internal cursor/registry names), and one stale reference to a
  `Store::window_host` that never existed (the form branch is
  `sweep_window`'s engine-enum match)
- `clamped` runs its arithmetic in u64 and narrows to usize after
  clamping, so a wide u64 offset can never wrap onto a small slice
  position on narrow-pointer targets; the cursor contract tests pin
  the overflowing-offset and overflowing-length forms
- zero rustdoc warnings under RUSTDOCFLAGS=-D warnings

Verification: cargo test (69+19+3 green), cargo test --all-features
(124+54+4 green), cargo clippy --all-targets -- -D warnings green,
cargo fmt --check green, RUSTDOCFLAGS=-D warnings cargo doc --no-deps
green.

src/error.rs

@@ -3,11 +3,12 @@
 //! **One enum, both altitudes.** This is a *single* enum serving both
 //! altitudes of the crate's surface. The [`Backend`][crate::backend]
 //! trait's methods return this family but its *effective* members are
-//! [`Missing`], [`Verification`], [`Io`], and [`KeyInvalid`] — at the
-//! trait boundary, keys arrive opaque (so `KeyInvalid` never fires
+//! `Error::Missing`, `Error::Verification`, `Error::Io`, and
+//! `Error::KeyInvalid` — at the
+//! trait boundary, keys arrive opaque (so `Error::KeyInvalid` never fires
 //! there) and GC delete-arbitration answers flow up as data, not as
-//! errors (so `GcRefuse` never fires below the facade). The facade's
-//! public surface re-exposes this same family with [`GcRefuse`] added:
+//! errors (so `Error::GcRefuse` never fires below the facade). The facade's
+//! public surface re-exposes this same family with `Error::GcRefuse` added:
 //! the facade decides and owns the refusal. The altitude discipline is
 //! carried by doc comments and construction discipline, not by two
 //! separate types (named design point audited at the review gate;