Document the lossless-revert conversion design in LibERC4626 (per the #70 REVERT ruling)

[thedavidmeister]

The #70 ruling (REVERT, 2026-07-05) requires the source to explain itself. Add @dev prose to LibERC4626.convertToAssets/convertToShares (and/or the op-level run() docs) covering:

1. Conversions are LOSSLESS BY DESIGN and revert on precision loss — an input Float finer than the token's decimals is the expression author's bug; round explicitly (floor/round float words) before converting.
2. The output path packs the vault's integer return exactly at all economic magnitudes: the int224 coefficient bounds it at raw ≥ ~1.35e67 (~1.35e49 whole tokens at 18 decimals) — CoefficientOverflow there implies a broken/adversarial vault, not a precision design flaw.
3. Cross-reference: the neutral no-validation wording from docs(natspec): document integrity unused params and untrusted vault in run() #217 stands; this ADDS the why.

Standard NatSpec prose only (no @Custom: — org gate). QA per QA-GUIDE.md: docs accuracy verified against LibDecimalFloat's actual bounds.

🤖 Generated with Claude Code

[thedavidmeister]

Scope addition (from the #102 ruling): also document the integrity() convention in the same pass — integrity functions declare arity by RETURN VALUE; the framework compares returned vs declared counts at parse time; the declared-count parameters are for operand-dependent-arity words and fixed-arity words ignore them by design. One @dev sentence at the integrity() sites ends the audit re-flagging cycle (#29, #102, #210 all touched this shape).