fix: reject malformed base64 padding

[vycdev2]

Summary

• Reject malformed Base64 padding instead of decoding it into unexpected bytes.
• Enforce terminal padding placement and zero unused padding bits while preserving valid Base64 decoding.
• Add a runtime-failure fixture for an invalid padded input.

Verification

• cargo fmt --all -- --check — passed.
• cargo check --workspace — passed.
• cargo build --workspace — passed.
• cargo test -q — passed (433 driver fixtures; all workspace tests passed).
• cargo test -q -p jett_driver base64_decode_rejects_invalid_padding — passed.
• cargo test -q -p jett_comptime — passed (245 tests).
• cargo run -q -p jett_cli -- format --check tests/runtime_fail/base64_invalid_padding.jett — passed.
• git diff --check upstream/main...HEAD — passed.
• Strict clippy was attempted for the affected packages; it is blocked by pre-existing warnings in jett_lexer, jett_comptime, jett_driver, and jett_comptime::verify, including the existing Base64 length modulo check. No new clippy warning was isolated to the changed behavior.

Risk

• Low: valid Base64 output and decoding remain unchanged; malformed padding now returns the existing runtime error path instead of silently producing data.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

[vycdev]

Strict Base64 padding validation is correct in isolation and its focused/full tests passed, but this branch now conflicts with current main in the shared interpreter/fixture area. Please rebase, preserve the already-merged checked-math and string regressions, and rerun comptime/driver plus full workspace tests.