fix stale byte in negated glob class with glob_no_wild_separator

[sage-mode-hunter]

Converting a negated glob class with PCRE2_CONVERT_GLOB_NO_WILD_SEPARATOR emits one extra character:

• convert_glob_parse_range writes "[^" plus the wildcard separator into the shared out_str scratch, then always emits a count of len + 1
• the no-wildcard-separator flag skips the separator store, so that count now includes a leftover byte from an earlier write into out_str
• [!a] converts to [^sa] (the "s" survives from "(?s)"), and a*[!b] to [^Cb] (from "(*COMMIT)")

Count only the units actually written. Added glob_no_wild_separator negated-class cases to test 24; they fail before the change and pass after.

[NWilson]

I'd like to accept this fix, but I've unfortunately made the 10.48 branch, and I don't want to add any delay.

This will have to wait a week!

[sage-mode-hunter]

No rush at all, happy for this to land whenever the 10.48 dust settles.

[fallenmi]

Reviewed exact base 92baa6cb647d89385aa9d550bc6614df881d8c2b and exact head 4a9498de86e4378f42c932ee7ee956e0bc002d97.

The length accounting is correct in both branches: len now advances only when the separator is actually written, so glob_no_wild_separator emits exactly [^, while the existing separator and escaped-separator paths retain their previous output length.

I verified the bug independently with three converter cases. The exact base produced [^sa], [^sxy], and [^Cb]; the exact head produced the intended [^a], [^xy], and [^b]. On both exact trees, PCRE2 test 24 passed for the 8-, 16-, and 32-bit libraries, and the head returned the corrected oracle output in all three widths. git diff --check is clean, and all 32 current non-skipped CI checks pass.

Disclosure: this review was prepared with Codex assistance; I independently verified the complete diff, exact SHAs, converter outputs, local tests, and current CI state before submitting it.