Reconcile spliced sample counts in signed space; absorb one-sample rounding drift (fixes #68, #39)

[jlivingston-Cipher]

Follows up on #75's invitation to send fixes for the recently filed issues.

Root cause

As analyzed in #68 and independently measured in #39: the objects-to-3OA
splice (wav_file_splicer.cc) computes per-segment sample counts by
floor()-ing double products of parsed ADM durations. When a segment
boundary falls on an exact sample but the double product rounds just below
it (e.g. 163.89 s × 48000 Hz = 7866719.99999999906…), the splice comes up
one sample short. The final reconciliation —
fabs(num_samples_count - *total_samples_per_channel) — then promotes the
int count through unsigned arithmetic, so the −1 shortfall wraps to
~1.84467e+19 and the CHECK aborts (SIGABRT). Whether a given input trips
this depends only on which way the products round, which is why roughly
half of plausible authoring grids crash (boundary table in #68).

fecb716 moved the total sample count into integer space; the
per-segment products and the final reconciliation still ran through
doubles and unsigned promotion. This PR completes that arc:

• Reconcile in signed 64-bit space and return a Status instead of
  crashing.
• Absorb a one-sample shortfall by splicing the still-unread remainder
  through the panner, so the output stays sample-exact (no padding, the
  real final sample).
• Convert the per-segment and total-duration CHECKs on input-dependent
  values to Statuses (an encoder should not abort on valid input).
• Add a regression test — the first to exercise the Dolby objects-to-3OA
  path: a 6005-sample mono ADM BWF (00:00:00.12510 at 48 kHz, i.e. the
  5-decimal ADM timecode quantization of 0.125104166… s) that previously
  crashed with Issue Check failed: fabs(num_samples_count - *total_samples_per_channel) <= kErrorTolerance #39's exact signature and must now produce sample-exact 3OA
  output.

What this deliberately does not do: re-time the segmentation.
Per-segment lengths are computed exactly as before, so output for inputs
that already worked is unchanged (verified below).

Verification (Linux, at dd03679)

• wav_file_splicer CHECK failure (SIGABRT) on ~half of uniform object automation grids — unsigned underflow in sample reconciliation #68's repro reproduces pre-fix at dd03679 (SIGABRT,
  wav_file_splicer.cc:436, magnitude 1.84467e+19) and completes cleanly
  post-fix (exit 0, valid .iamf).
• No-regression control: two automation grids that already passed
  (200-block and 1000-block, from the generator cited in wav_file_splicer CHECK failure (SIGABRT) on ~half of uniform object automation grids — unsigned underflow in sample reconciliation #68) produce
  byte-identical .iamf output pre/post fix.
• The new test fails on the unfixed code (dies on the same CHECK) and
  passes with the fix, asserting the panned output is exactly
  6005 × 16 ch × 3 B.
• bazelisk test -c opt --test_output=errors iamf/... (the repo's CI
  suite) is green on this branch across the full matrix — linux-amd64,
  macos-arm64, macos-amd64, windows, plus the test-vector generator
  (fork Actions run
  30877230150);
  //iamf/cli/adm_to_user_metadata/adm/tests:wav_file_splicer_test
  PASSED.
• git-clang-format dd03679 is idempotent on the change.

On #37: fecb716 addressed that report's total-samples computation; this
change converts the remaining aborts in the same function to clean errors.

Contributor agreement: executed and on file since 2026-07-27 (per
CONTRIBUTING), as with #78.

[jlivingston-Cipher]

Thanks