bufio: readahead signals overflow when it cannot grow (F-B)

The scanner readahead silently fell through when start==0 and the
buffer was full at maxread, producing no bytes and no error. scanbyte
then spun forever re-requesting bytes that never came (catB-144) and
scanrune nil-dereferenced s.ptr[s.start] (catB-145).

Make readahead the single overflow choke-point: at the ceiling it
returns a bufio-local `overflow` before the grow, propagated through
scanbyte/scanrune/scanbytes (scanbytes drops its now-redundant manual
pre-check). Mirrors ref/hare/bufio/scanner.ha:174-182, which returns
errors::overflow there; ww uses bufio-local overflow because io.error
is a closed enum without an overflow member. Consumers (regex, the 778
embedded source) gain the totality arm.

Table-driven @test crosses {nil-ptr, zero-len} x {scanbyte, scanrune};
neutralizing the overflow return reproduces the catB-144 hang.

test/wcc/778_bufio_vstream_run.c

@@ -326,6 +326,7 @@ static const struct row rows[] = {
 	  "    case let b: u8 => { fb = b; };\n"
 	  "    case io.eof => { return 81; };\n"
 	  "    case let e: io.error => { return 82; };\n"
+	  "    case bufio.overflow => { return 92; };\n"
 	  "    };\n"
 	  "    if (fb != 65u8) { return 83; };\n"
 	  "    match (bufio.scanbytes(&sc, 44u8)) {\n"