fix(decode): overflow-check uint and float32 destinations

Assisted-by: GLM 5.3

CHANGELOG.md

@@ -63,14 +63,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   and nested arrays of tables: `[[a]]`, `b.c = 1`, `[[a]]`, `[a.b]` parses, as
   the TOML examples in the spec shape it. The records of the previous element
   falsely rejected the same paths in the next one.
-- `UseLiteralMultiline` falls back to the escaped basic string when the value
-  cannot be carried verbatim by the literal form: a run of three single quotes,
-  a control character, or a lone carriage return. Such values previously
-  produced output that did not re-parse.
 - `Marshal` returns an error for a table header key or an inline-table key that
   is not valid UTF-8, the way scalar keys already did, instead of silently
   emitting corrupt TOML (a header that lost its key, an inline table with a
   missing key).
+- `UseLiteralMultiline` falls back to the escaped basic string when the value
+  cannot be carried verbatim by the literal form: a run of three single quotes,
+  a control character, or a lone carriage return. Such values previously
+  produced output that did not re-parse.
+- Decoding into a `uint` destination checks the type's platform width instead
+  of only the fixed widths, so a 32-bit `uint` no longer truncates silently;
+  decoding a finite float beyond the `float32` range is an overflow error
+  instead of a silent infinity.
 - Struct fields that resolve to one key at equal depth decode through the
   field declared later, matching the documented rule; the first one won before.
 - A float with an exponent marker but no digits (`1e`, `0.0E`) is rejected;