fix(formatter): avoid usize underflow on over-wide comment prefixes - #10035

Summary

Fixes an integer underflow (panic) in format_leading_comment when computing max_comment_width. The subtraction of cur_indent, n_slashes, n_exclamations, and n_leading_spaces from max_line_width is now done with saturating_sub to prevent wrapping/panicking when the prefix length exceeds max_line_width.

Type of change

Please check one:

• Bug fix (fixes incorrect behavior)
• New feature
• Performance improvement
• Documentation change with concrete technical impact
• Style, wording, formatting, or typo-only change

Why is this change needed?

When a comment line has a prefix (indentation + slashes + exclamations + leading spaces) whose total length exceeds max_line_width, the plain arithmetic subtraction would underflow in debug builds (panic) or wrap in release builds, producing an enormous max_comment_width value and incorrect formatting behavior. This is a real scenario with long section-divider comments made of many slashes.

What was the behavior or documentation before?

A comment like:

//////////////////////////////////////////////////////////////////////////////////////////////////////////// section divider
fn f() {}

would cause a panic (debug) or silent integer wrap (release) during formatting due to the underflow when computing the available comment width.

What is the behavior or documentation after?

max_comment_width saturates to 0 instead of underflowing, allowing the formatter to handle over-long comment prefixes gracefully. The comment is wrapped correctly:

//////////////////////////////////////////////////////////////////////////////////////////////////////////// section
//////////////////////////////////////////////////////////////////////////////////////////////////////////// divider
fn f() {}

A new test case (comment_overflow.cairo) is added to cover this scenario.

Related issue or discussion (if any)

N/A

Additional context

The fix is minimal and surgical — only the four subtractions in format_leading_comment are changed to use saturating_sub.