fix: harden rpscan argument parsing

[sit-d]

Summary

• reject signed or blank --max-depth values before calling wcstoull
• reject parsed values above UINT32_MAX instead of silently truncating them into the uint32_t depth limit
• copy the variadic argument list before the first formatting attempt so the fallback formatting path does not reuse an already-consumed va_list

Verification

• gcc -Wall -Wextra -Werror /tmp/hermes-verify-tools-rpscan-*.c -o /tmp/hermes-verify-tools-rpscan-* on a dependency-free extraction of parse_u32
• ran the verifier binary against valid boundary cases (0, 42, 0xffffffff, 4294967295) and invalid cases (blank, signed, trailing junk, 4294967296, 0x100000000)
• git diff --check

The temporary verifier exited 0 and was removed.

Notes / limitations

• Full Windows cl/clang-cl build was not run from the Linux cron environment because Windows SDK headers/libraries are unavailable here.
• Existing open PRs docs: list hdrinfo in tool summaries #2 and docs: add hdrinfo Pages posts #3 are documentation/Pages-only changes; this is a separate source-level robustness fix for rpscan.c.

[sit-d]

Fresh post-PR verification: ad-hoc verifier /tmp/hermes-verify-tools-rpscan-post-33kf3wdu.c compiled with gcc -Wall -Wextra -Werror, exercised parse_u32 boundary/invalid cases (0, 42, 0xffffffff, 4294967295, blank/signed/trailing-junk/overflow inputs), checked rpscan.c contains the va_copy/va_end and UINT32_MAX/sign guards, and ran git diff --check HEAD~1..HEAD. It exited 0; verifier source and binary were removed.