guard repeat-end against empty stack in _yr_re_fiber_sync

[jmestwa-coder]

The RE_OPCODE_REPEAT_END handler in _yr_re_fiber_sync does fiber->stack[fiber->sp]++ without checking that sp is not negative:

• sp starts at -1 and only a preceding REPEAT_START advances it to 0
• a hand-crafted .yrc can reach REPEAT_END with no matching REPEAT_START, so stack[-1]++ writes into the fiber's next pointer and the later fiber traversal follows the corrupted value
• the REPEAT_START push already carries the paranoid upper-bound guard, only this lower bound was missing

Added the sp < 0 guard under YR_PARANOID_EXEC. A regexp of a single REPEAT_END opcode gives an ASAN SEGV in _yr_re_fiber_split before the patch and a clean ERROR_INTERNAL_FATAL_ERROR after; regression test added in test-re-split.c.