fix(TC-1277): saturate SpaceSizes decrement

[samgbafa]

Linear: TC-1277

SpaceSizes::decrement_size (shared by the FS and S3 stores) used an unchecked subtraction. A double remove or accounting drift panics in debug builds and wraps to ~u64::MAX in release, which would make quota checks reject all writes to the space.

Change: *s = s.saturating_sub(size), matching the saturating behaviour in #336. Adds a unit test that removes more than was added and asserts the size floors at 0 (panics with 'attempt to subtract with overflow' without the fix in a debug build).

Verification: cargo test --lib storage, cargo fmt --check, cargo clippy --all-targets -- -D warnings.

[samgbafa]

APPROVE: see TC-1277 (reviewed exact head 3dda976). One file: decrement_size now floors at 0 via saturating_sub (it was an unchecked subtract: a release-mode wrap or a debug panic); the unused SubAssign import is removed; the unit test covers an over-decrement plus a decrement at 0. No other behaviour change.