fix: reject a year Date.UTC would silently move

`iso()` read back the month and the day to catch February 30 rolling over to
March 2, and took the year on trust. `Date.UTC` maps years 0–99 into the 1900s,
so a four-digit "0050" came back as 1950 with the month and day intact — past
both existing checks, because nothing about the resulting date is impossible.

Same class of failure as the rollover the guard was written for: a boundary the
source never stated, published as though it had. Reading the year back too is
the skip-rather-than-guess rule this module runs on, applied to the one field
that was not checked. It narrows only — `parseShortSlashRange`'s two-digit pivot
produces full years and is untouched.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

src/ingest/dates.ts

@@ -40,8 +40,19 @@ function iso(
     return null;
   }
   const date = new Date(Date.UTC(y, m - 1, d, hh, mm, ss, 0));
-  // Rejects impossible calendar dates such as February 30.
-  if (date.getUTCMonth() !== m - 1 || date.getUTCDate() !== d) return null;
+  // Rejects impossible calendar dates such as February 30 — and a year that did
+  // not survive the round trip. `Date.UTC` maps 0–99 into the 1900s, so a
+  // four-digit "0050" becomes 1950 with the month and day intact, which the two
+  // checks beside this one cannot see. Reading the year back is the same
+  // skip-rather-than-guess rule the rest of this module runs on, applied to the
+  // one field that was taken on trust.
+  if (
+    date.getUTCFullYear() !== y ||
+    date.getUTCMonth() !== m - 1 ||
+    date.getUTCDate() !== d
+  ) {
+    return null;
+  }
   return date.toISOString();
 }