fix: preserve byte widths when skipping invalid UTF-8 in Substring

[jakezwang]

Substring("\xffa", 1, 1) panics, and skipping an invalid byte in longer strings can discard valid trailing characters. The positive-offset path uses utf8.RuneLen on the replacement rune, which reports three bytes even when range consumed one invalid byte.

Use the decoded byte width at that position. Regressions cover the panic, incorrect truncation, consecutive invalid bytes, and a valid U+FFFD character.

Validation: the three invalid-input cases fail before the fix. Full tests pass on Go 1.18.10; full race tests pass on Go 1.26.6 and 1.27.1. Golangci-lint passes, and the existing substring benchmarks remain allocation-free. One initial Go 1.27 run missed the unrelated TestWaitFor timing tolerance; the full rerun passed.