printfRecord: fix one-byte VAL overflow in %ls conversion

In the long-string (%ls) branch dbGetLink(DBR_CHAR) / dbLoadLinkLS can
leave n at vspace+1, so pval[n] = 0 writes at pval[vspace+1], one byte
past the sizv-byte VAL buffer (pval + vspace + 1 == prec->val + sizv).
Clamp n to vspace immediately before writing the terminator.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

modules/database/src/std/rec/printfRecord.c

@@ -250,6 +250,8 @@ static void doPrintf(printfRecord *prec)
                             int padding;
 
                             /* Terminate string and measure its length */
+                            if (n > vspace)
+                                n = vspace;
                             pval[n] = 0;
                             added = strlen(pval);
                             padding = width - added;