fix: address spm-lab-repository-audit-bot issues #237-#243

[shinaoka]

Addresses the six open issues from spm-lab-repository-audit-bot:

Issue	Fix
#237	DiscreteLehmannRepresentation::new/with_poles return a typed DlrError instead of panicking on insufficient default poles or kernel/statistics mismatch. spir_dlr_new/spir_dlr_new_with_poles map it to SPIR_INVALID_ARGUMENT/SPIR_NOT_SUPPORTED instead of collapsing to SPIR_INTERNAL_ERROR.
#238	NaN lambda/epsilon no longer passes the <= 0.0 guards in spir_logistic_kernel_new, spir_reg_bose_kernel_new, spir_sve_result_new (!is_finite() added); same hardening for the core RegularizedBoseKernel::new and the spir_basis_new* parameter guards.
#239	spir_basis_get_default_matsus_ext never writes past the caller's n_points buffer. With mitigate=true, fencing output is clamped to the buffer (explicit partial-output semantics documented); truncation is observable via spir_basis_get_n_default_matsus_ext. Rust + C++ regression tests updated.
#241	RegularizedBoseKernel + fermionic statistics rejected at the C ABI boundary (spir_basis_new, spir_basis_new_from_sve_and_regularizer) with SPIR_NOT_SUPPORTED, instead of deferring a downstream panic.
#242	Library code no longer writes to stderr unconditionally: warnings routed through a new SPARSEIR_DEBUG-gated debug_warn! macro (the dlr.rs warning was removed — superseded by the #237 typed error).
#243	Regenerated sparse-ir-capi/assets/sparse_ir_capi.h from the cbindgen output (c_complex/int *status ABI drift eliminated) and added a header-sync CI job that fails when the generated and checked-in headers diverge (cbindgen pinned to 0.29.2).

Notes

• Public signatures of all C ABI functions are unchanged; Python ctypes bindings, Fortran wrappers, and the generated header consumers are unaffected (verified: no signature drift).
• The fix(capi): spir_basis_get_default_matsus_ext unchecked write still overflows caller buffer with mitigate=true (residual of #199) #239 fix uses the issue's option (b) (clamp + explicit partial output): with this API the request parameter doubles as the buffer capacity, so option (a) (error) would make the mitigate=true path unusable — fencing output always exceeds the request, so an error could never succeed.

Verification

• cargo test --workspace --release: 349 passed, 0 failed
• C++ cinterface tests: 274 assertions, all passed
• Header sync: cbindgen output == committed generated header == assets copy