Reconcile ARPA writer output with actual trie counts

[lenzo-ka]

ngram_model_trie_write_arpa wrote each n-gram section's count from the stored header (base->n_counts) and asserted that the number of n-grams recovered by walking the trie matched. When a model's header disagrees with its trie content, that assertion aborts the program; with assertions disabled the writer indexes the raw_ngrams array beyond the entries actually filled, dereferencing NULL word pointers or writing past the allocation.

The shipped model/en-us/en-us.lm.bin triggers this: its header declares 2051547 bigrams while the trie holds 2051541 (the six extra header slots are zero-padding). Converting it to ARPA aborts.

This discovers the true per-order counts by walking the trie before writing anything, and emits those counts so the output is always self-consistent. lm_trie_fill_raw_ngram now takes a capacity: it stops writing once the destination array is full but keeps counting, so the actual count is known without overflowing. When the header and the trie content disagree, the writer logs a warning and writes the actual counts; conversion of the en-us model now succeeds with a warning instead of aborting. Output for a consistent model is unchanged (byte-identical).

test-lm-convert-mismatch.sh converts the en-us model and checks that the writer warns, does not crash, and produces an ARPA whose declared counts equal the lines in each section. test_lm_write_consistency checks that a consistent model still writes an ARPA whose counts match its sections.

Tested on macOS (Apple clang) and Linux x86-64 (GCC 13.3); full unit and regression suite passes on both.

Fixes #502