Fix to_msgpack() reading the inactive number union member

[nlohmann]

Summary

to_msgpack() reads the wrong member of the number_integer/number_unsigned union in write_msgpack() when
number_integer_t is narrower than number_unsigned_t (e.g. basic_json<..., std::int32_t, std::uint64_t, ...>).
In the number_unsigned case, every branch wrote number_integer's (inactive, narrower) bits instead of
number_unsigned's, silently producing the wrong value whenever it did not fit in number_integer_t. In the
number_integer case (non-negative branch), the encoded width was chosen by comparing number_unsigned's
(inactive) bits, which is undefined behavior, though the value actually written was still number_integer's.
With the default std::int64_t/std::uint64_t pair both members have the same width and representation, so the
output was unaffected there.

Changes

• include/nlohmann/detail/output/binary_writer.hpp: in write_msgpack(), read the active union member in both
  the number_integer and number_unsigned cases (matching CBOR, UBJSON, BJData, BSON, and BON8, which already
  do).
• docs/mkdocs/docs/api/basic_json/to_msgpack.md: add a "Version history" entry for the fix.
• single_include/nlohmann/json.hpp: regenerated via make amalgamate.

Tests

Added tests/src/unit-msgpack.cpp / TEST_CASE("MessagePack numbers use the active union member (see #5644)"),
using basic_json<std::map, std::vector, std::string, bool, std::int32_t, std::uint64_t, double> (and an
std::int16_t variant) to reproduce the issue's two examples (6442450944 and 4294967496) plus the issue's
16-bit example (98304): each value must encode to the documented correct bytes and round-trip through
from_msgpack(). A fourth section checks a default-type (std::int64_t/std::uint64_t) value is unaffected.

• Verified the new test case fails without the fix (built against include/ from develop@633de8e44, with the
  same three assertions failing with exactly the corrupted values the issue reports: 18446744071562067968,
  200, and 4294934528).
• Built and ran tests/src/unit-msgpack.cpp with the fix for C++11 and C++17
  (clang++ -O1 -g -Wall -Wextra -Werror -fsanitize=address,undefined -fno-sanitize-recover=undefined): all test
  cases pass, no sanitizer reports.
• Did not run the full test suite (per repo convention, CI covers that).

Public API

No breaking changes. This only fixes the bytes to_msgpack() writes for basic_json instantiations where
number_integer_t is narrower than number_unsigned_t; no signatures or types changed.

Fixes #5644

---

This PR was written by Claude Code on behalf of @nlohmann.

🤖 Generated with Claude Code

[gregmarr]

Is it worth only casting once?

  auto value_as_unsigned = static_cast<typename BasicJsonType::number_unsigned_t>(j.m_data.m_value.number_integer) ;
  if (value_as_unsigned < 128)

[nlohmann]

Done in 9d415f0 (value_as_unsigned).

(Reply written by Claude Code on behalf of @nlohmann.)

[gregmarr]

Does this need to be static_cast<std::make_unsigned<typename BasicJsonType::number_integer_t>> to prevent truncation if number_unsigned_t is smaller than number_integer_t?

[nlohmann]

Good thought, but that configuration can no longer be instantiated: since #5443, basic_json has static_assert(sizeof(NumberUnsignedType) >= sizeof(NumberIntegerType), ...), so every non-negative number_integer_t value fits in number_unsigned_t and the cast can't truncate. std::make_unsigned<number_integer_t> would be the same width or narrower, so it wouldn't add anything here. I verified this by trying to add a test with number_integer_t = std::int64_t, number_unsigned_t = std::uint32_t — it fails to compile on that assertion.

(Reply written by Claude Code on behalf of @nlohmann.)

[gregmarr]

Good thought, but that configuration can no longer be instantiated:

Perfect.