test: the device runner refuses an image that runs past flash end

A boot-linked image larger than its slot cannot execute on hardware, and
the naive copy smashed the heap beyond avr->flash — after which the
simulation misbehaved in ways that pointed everywhere but at the size:
phantom byte losses on the UART, garbage in SPMCSR, all downstream of
the overrun. The size gate had said it plainly; now the runner does too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/device.c

@@ -65,6 +65,15 @@ int main(int argc, char *argv[])
 		fprintf(stderr, "device: cannot read %s\n", argv[1]);
 		return 1;
 	}
+	// An image that runs past flash end cannot execute on hardware, and a
+	// naive copy of it would smash the heap beyond avr->flash — after which
+	// the simulation misbehaves in ways that point everywhere but here.
+	// Refuse it loudly instead.
+	if (boot_base + fw.flashsize > avr->flashend + 1) {
+		fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n",
+		        (unsigned)fw.flashsize, boot_base, avr->flashend);
+		return 1;
+	}
 	memcpy(avr->flash + boot_base, fw.flash, fw.flashsize);
 	avr->pc = boot_base;
 	avr->codeend = avr->flashend;