-check-overflow: a -prod program panics in vlib code that wraps on purpose (map hash, byte search, json2, crypto) #32316

Under -prod with a C compiler other than tcc and msvc, parts of vlib run V code whose arithmetic wraps by design, and none of it carries @[ignore_overflow], so -check-overflow instruments it and the program panics on its first string-keyed map, short byte search or password hash:

import json2

fn main() {
	println(json2.decode[map[string]string]('{"name":"abcdefghijklmnop"}') or { panic(err) })
}

v -prod -check-overflow run t.v
V panic: attempt to mul with overflow(u64(4) * u64(5418857496715711651))
V panic: attempt to sub with overflow(u64(16958013708986730) - u64(72340172838076673))

Found so far:

• the map hash map_hash_bytes (vlib/builtin/map.c.v, wyhash's multipliers);
• the word-wise byte searches string_index_byte, string_index_pair, string_contains_byte and string_last_index_byte (vlib/builtin/cfns_wrapper.c.v, the (x - 0x0101010101010101) & ~x & 0x8080808080808080 test);
• json2's word_has_byte (vlib/json2);
• vlib/crypto: Argon2 (via blake2b) panics with attempt to add with overflow(u64(13503953896175478587) + u64(11170449401992604703)); no file of vlib/crypto (blake2b, argon2, sha256, sha512, hmac, …) carries the attribute.

Without -prod the builtin paths are compiled out ($if prod && !tinyc && !msvc). hash/wyhash.v, strconv/f64_str.c.v and rand's generators already mark their wrapping functions.

Two possible shapes:

(a) @[ignore_overflow] on every vlib function that wraps on purpose: an audit of builtin, json2, crypto, hash and rand, each with a // vtest vflags: -prod -check-overflow test. I'll open a PR in this shape.

(b) Give + - * the rule that negation and shift counts already have: -check-overflow instruments only the program's own code (user_overflow_checks_active, file_gets_user_code_checks in vlib/v/gen/c), since vlib relies on V's defined wrapping. That also needs a program's files to count as program code wherever they live: vlib/v/tests/builtin_overflow_test.v builds its programs under vlib/v/tests/testdata/, which the rule would count as vlib.

Either way, a -prod -check-overflow build of a program that uses maps, string search, JSON or crypto cannot run today.