metal: convolution ring lookup overflows at valid high positions #795

A public delta_rows call with pos = u32::MAX - 9 and nine rows passes check_rows. In tap_x, row 0 with distance 1 computes ring slot 0 instead of slot 4 because pos0 + RING_ROWS - back wraps before the modulo. Distinct finite ring values therefore produce incorrect convolution inputs and recurrent state without a fault. This expression already exists on the base branch. After the existing pos0 < back guard, compute (pos0 - back) % BLOOMERY_DELTA_RING_ROWS. Apply the same subtraction to the shared oracle's tap, whose current addition also overflows. Add a boundary case checked against independently calculated predecessor slots.

Evidence (at the base of #792):

• crates/metal/kernels/delta.metal:144
• crates/metal/src/kernels/delta.rs:495
• crates/metal/kernels/delta.metal:673
• crates/metal/src/bin/shared/oracle_delta.rs:329

_{Filed by Shingler, the review bot, while reviewing #792; the defect is outside that pull request.}