Validate stream and window update ranges

[OskarEichler]

Summary

• reject negative stream identifiers instead of masking them to 31 bits
• reject zero and negative WINDOW_UPDATE increments instead of encoding them as zero/large positive values
• retain the existing upper-bound checks

Reproduction

Framer#generate previously validated only upper bounds. The later bit mask serialized stream -1 as 2^31-1, while WINDOW_UPDATE 0 and -1 became reserved zero and 2^31-1 respectively. Those inputs are outside the frame contracts and should fail before encoding.

Verification

• 448 examples, 0 failures on Ruby 4.0.6
• focused rejection checks for stream -1 and increments 0/-1
• existing valid boundary/frame examples remain green
• syntax and RuboCop pass

No repository tests were changed. I used an AI coding assistant during investigation and verification.