GeezerVison

`Unpacker.read_bytes()` does not reject negative lengths. The C
extension raises an internal `SystemError` from
`PyBytes_FromStringAndSize`; the Python implementation accepts the count
and can return an unintended slice of buffered data.

Raise `ValueError` for a negative byte count before reading or updating
the stream position in either implementation. Four regression cases
cover feed-based and file-based unpackers with `-1` and a larger
negative count. They also check that the failed call leaves the position
unchanged and that zero-length reads and subsequent reads/unpacking
still work.

On Windows/Python 3.13, all four cases fail with each unchanged
implementation. With the fix, the complete C-extension suite has 164
passed and 1 skipped; the Python suite has 161 passed and 4 skipped.
Both retain three existing unknown-marker warnings for `thread_unsafe`
when the free-threaded test plugin is absent. Repository-wide Ruff lint
and format checks pass. Other OS/Python and free-threaded matrices were
not run locally.

Related: #742 validates negative sizes in the packer header APIs; this
change covers the unpacker's raw-byte reader. #752 concerns short
feed-based reads, which is a separate case.

AI assistance: OpenAI Codex investigated, generated and self-reviewed
the patch, and ran the local checks. No separate human review is
claimed.