fix: bounds-check tigris_mem_load_tile height window to fail closed on out-of-range rows

[asteinh]

Summary

tigris_mem_load_tile did not bounds-check its [h_start, h_end) row window against the
source tensor height, so a malformed or mis-tiled plan requesting rows outside [0, H]
would read past the tensor (an out-of-bounds read). tigris_mem_load_tile_2d already has
this guard; this adds the matching one to the 1D primitive.

Defense-in-depth companion to the compiler fail-closed guard for a post-spatial strided
external skip: the runtime never OOB-reads even on a hand-built or future plan.

Change

• tigris_mem_load_tile: if (h_start < 0 || h_end <= h_start || h_end > H) return TIGRIS_MEM_ERR_BAD_INDEX;, mirroring tigris_mem_load_tile_2d. The caller
  (exec_stage_tiled) already propagates the error.
• Test test_load_tile_1d_rejects_bad_bounds: a valid h_end == H window still loads;
  negative h_start, h_end == h_start, and h_end > H are rejected. Without the guard
  the negative case SIGSEGVs; with it, the test passes.

Testing

test_tile_2d: 409 passed. Runtime unit tests green. ASan/UBSan clean on the load_tile
exercisers (test_tile_2d, test_executor, test_row_offset). Stack-usage gate run locally.