Reject oneofs whose member fields are not declared consecutively - #688

Summary

DescriptorPool now rejects a oneof whose members are separated in declaration order by a field outside that oneof. This matches protoc's requirement that members of the same oneof be declared consecutively.

The check lives beside the existing empty-oneof validation and returns PoolError::NonconsecutiveOneofFields. It checks declaration order, not field numbers: adjacent members with nonconsecutive or unsorted numbers remain valid. Code generation and codecs are unchanged.

This affects hand-built or synthesized descriptor sets. Normal protoc-generated descriptors already follow the rule.

Fixes #636.

Testing

• Added rejection tests for proto2, proto3 and editions 2023, top-level and nested messages, and separators belonging to no oneof or a different oneof.
• Verified the error on fresh pool construction and that a failed addition leaves an existing pool unchanged.
• Added a valid control with unsorted field numbers and a single-member oneof.
• The rejection regression fails on original main; the valid control passes. All 143 pool_e2e tests pass with the fix.
• task lint and task test pass with the pinned Rust toolchain and protoc 33.5.

Includes a changelog fragment. No generated code changes.