Fix out-of-bounds read in Rust derive-method synthesis

The derive-method synthesis loop tested di_entry->methods[mi].short_name before the mi < 4 bound, so at mi==4 it read methods[4] — one past the 4-element array (UBSan: index 4 out of bounds for DeriveMethod[4]). Evaluate the mi < 4 bound first so the dereference is guarded.

internal/cbm/lsp/rust_lsp.c

@@ -4445,10 +4445,10 @@ static void rust_build_registry_from_defs(CBMArena* arena, CBMTypeRegistry* reg,
                         new_arr[existing + 1] = NULL;
                         rt->embedded_types = new_arr;
 
-                        /* Synthesize methods. */
+                        /* Synthesize methods. Bound `mi < 4` BEFORE dereferencing
+                         * methods[mi] so we never read methods[4] (OOB). */
                         for (int mi = 0;
-                             di_entry->methods[mi].short_name &&
-                             mi < 4; mi++) {
+                             mi < 4 && di_entry->methods[mi].short_name; mi++) {
                             const struct DeriveMethod* dm = &di_entry->methods[mi];
                             CBMRegisteredFunc rf;
                             memset(&rf, 0, sizeof(rf));