fix: 5项立即修复 + 2项尽快修复

立即:
- lexer: token数组容量改为src_len+16 + idx越界防御
- symbol: 4个函数arena_alloc加NULL检查
- codegen: verify_err fallback用arena_strdup替代静态字符串
- codegen: cleanup_list从固定64改为arena动态扩容
- lexer: 标识符/字符串字面量65535字符上限

尽快:
- to_llvm_type: TYPE_STRUCT/TYPE_UNKNOWN/TYPE_ERROR显式case
- LLVMGetValueType2不存在(LLVM 22仍用旧名), 保留GlobalGetValueType

src/lexer/lexer.c

@@ -70,7 +70,10 @@ static TokenKind check_keyword(const Token* tok) {
 
 static Token lex_ident_or_keyword(Lexer* l) {
     int start = l->pos;
-    while (isalnum(peek(l)) || peek(l) == '_') advance(l);
+    while (isalnum(peek(l)) || peek(l) == '_') {
+        if (l->pos - start > 65535) break;  // 标识符长度上限
+        advance(l);
+    }
     Token t = make_token(l, TOK_IDENT, start, l->pos - start);
     t.kind = check_keyword(&t);
     return t;
@@ -79,8 +82,9 @@ static Token lex_ident_or_keyword(Lexer* l) {
 Token* lex(Arena* a, const char* source, const char* filename,
            size_t* count, ErrorInfo* error) {
     Lexer l = {.src = source, .filename = filename, .pos = 0, .line = 1, .col = 1};
-    // 预估容量：源码长度的 1/3
-    size_t cap = strlen(source) / 3 + 16;
+    // 容量上限: 极端情况每个字符一个 token (如 "(){}+-"), src_len 足够
+    size_t src_len = strlen(source);
+    size_t cap = src_len + 16;
     Token* tokens = arena_alloc(a, cap * sizeof(Token));
     if (!tokens) { *count = 0; return NULL; }
     size_t idx = 0;
@@ -88,6 +92,7 @@ Token* lex(Arena* a, const char* source, const char* filename,
     while (peek(&l) != '\0') {
         skip_whitespace(&l);
         if (peek(&l) == '\0') break;
+        if (idx >= cap) { *count = 0; return NULL; }  // 防御
 
         int line = l.line, col = l.col;
         char c = peek(&l);
@@ -96,7 +101,10 @@ Token* lex(Arena* a, const char* source, const char* filename,
         else if (c == '"') {
             advance(&l);  // 跳过开头的 "
             int start = l.pos;
-            while (peek(&l) != '"' && peek(&l) != '\0' && peek(&l) != '\n') advance(&l);
+            while (peek(&l) != '"' && peek(&l) != '\0' && peek(&l) != '\n') {
+                if (l.pos - start > 65535) break;  // 字符串长度上限
+                advance(&l);
+            }
             int len = l.pos - start;
             if (peek(&l) != '"') {
                 *error = (ErrorInfo){.message="未闭合的字符串", .filename=filename, .line=line, .col=col};