Make the payload-reuse guards able to fail

TestConvertGeminiRequestToGeminiReusesLargeNormalizedPayload asserted the reuse
invariant with b.Fatal inside testing.Benchmark. A failing benchmark aborts
before completing an iteration and returns a zero BenchmarkResult, so
AllocedBytesPerOp reported 0 and the allocation check passed exactly when the
payload was being copied. Injecting a full copy into the translator left the
test green. Assert the invariant with t.Fatal and reject a zero-iteration
benchmark result; both injected regressions now fail the test.

Add two static guards for the no-copy invariant. Results handed out by the
no-copy helpers alias the caller's buffer, and mutating those bytes corrupts
already-derived values in a way the race detector cannot see. One guard rejects
in-place sjson options, the other keeps the set of in-place byte writes small
and documented: each reviewed site records why it cannot corrupt a no-copy
result, and a new site fails the test until it is justified.