Validate DEFLATE distance code range before table lookup

[trufae]

Motivation

• Prevent an out-of-bounds read in the bundled DEFLATE decoder by rejecting reserved/invalid distance symbols (30–31) before they are used to index the dist_base/dist_extra tables.

Description

• Add a single check in src/lib/deflate-dec.inc.c that returns Z_DATA_ERROR when distance_code > 29, keeping valid-stream behavior unchanged.

Testing

• Ran make, which completed successfully.
• Ran make -C test/unit run, which executed the unit tests; the suite ran but some pre-existing tests (e.g., test_mzip_deflate) report logical failures unrelated to this change.
• Ran make -C test, which failed in this environment due to missing external tools (xxd, file, 7z) used by the integration script.

---

Codex Task