refactor: harden library usability before 0.5.0

[tisonkun]

Summary

This PR addresses a small set of release-facing issues found during a pre-0.5.0 audit:

• make the new REQ iterator actually zero-allocation by borrowing retained items instead of cloning them;
• use the existing NumStdDev type for REQ rank confidence bounds so unsupported confidence levels are not representable;
• reject oversized encoded string lengths before FrequentItemsSketch<String> allocates from untrusted input;
• reject REQ images whose serialized extrema contradict their retained items;
• document the panic contracts of mutable T-Digest queries at their own call sites;
• remove two impossible signed-count assertions from unsigned frequent-item updates.

REQ is still unreleased, so tightening its iterator and confidence-bound APIs here avoids carrying immediately regrettable interfaces into 0.5.0.

Audit boundary

The audit intentionally excluded changes without a concrete failure mode or an established contract. In particular:

• Count-Min bound semantics were left unchanged after checking them against the Apache Java implementation.
• Count overflow behavior was left unchanged because saturation would alter merge semantics and the crate has no agreed overflow contract.
• REQ deep-size accounting was not added while the generic-value accounting question remains open in Define deep estimated-size accounting for generic sketch values #193.
• Existing tests were not removed merely for looking repetitive; the relevant suites are fast and exercise observable behavior boundaries.
• Open feature work such as Display implementations and KLL was not folded into this release-hardening PR.
• REQ deserialization hardening is not listed as a separate changelog item because REQ is new since 0.4.0; the release notes describe its final 0.5.0 contract instead of internal development history.

Commit structure

Each concern is isolated in a reviewable commit whose message records the reason for the change:

1. refactor(req): borrow items from the public iterator
2. fix(frequencies): validate string lengths before allocation
3. fix(req): validate serialized extrema against retained items
4. docs(tdigest): state mutable query panic contracts
5. refactor(req): type the confidence level parameter
6. refactor(frequencies): remove impossible count assertions
7. docs(changelog): omit unreleased REQ hardening

Validation

• cargo x prepare-testdata
• cargo x check
• cargo x test
• cargo x lint
• cargo package --list -p datasketches
• cargo publish --dry-run --locked -p datasketches

The publish dry-run packaged 99 files (1.9 MiB, 274.9 KiB compressed) and verified the package with Rust/Cargo 1.86.0.