fix state save/restore width mismatch in mj_recompile

[avionicharshit-byte]

fixes #3590 and #3586.

mj_recompile preserves qpos, qvel and act across a spec edit through SaveState / RestoreState. both size the copy by the current spec , not by the width that produced the address. editing a joint type or an actuator's actdim before recompiling then reads past the old state: hinge to free reads 7 values from a 1-wide slot in SaveState (#3586) , and actdim 1 to 3 reads 3 values from a 1-element saved vector in RestoreState (#3590). asan flags both , and the non-instrumented build silently produces a zero quaternion.

this records the joint type next to qposadr_ / dofadr_ in SaveDofOffsets (the same way actdim_ already sits next to actadr_) , reads the old data with that width , and restores a value only when the width is unchanged. when it changed , the joint gets qpos0 and zero velocity , and the actuator keeps the zero activations from MakeData. the keyframe path (StoreKeyframes / ResolveKeyframes) shares these functions and had the same latent overread , so it is covered too.

policy note: this picks "fall back to defaults and continue" over rejecting the recompile , since the reporter left that open. happy to switch to a warning or an error if preferred. a 1-dof swap (slide <-> hinge) keeps its value because widths match.

tests: PreserveStateJointTypeChanged and PreserveStateActdimChanged in test/user/user_api_test.cc , both crash under asan without the fix. user_api_test and the other test/user binaries pass under an asan build on macos arm64 (double precision).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[yuvaltassa]

already fixed