node:fs: validate buffer type before offset in fs.read/readSync - #32301

The `.unwrap_or(buffer)` fallback returns the *pre-coercion* snapshot — the one value (potentially stale ptr/len after detach) that the re-snapshot on this line exists to avoid. The None arm is provably unreachable (a JSCell's type is immutable; a detached view returns `Some` with `len=0`), so there's no runtime bug, but since the comment already states the invariant and continuing on a stale pointer would corrupt memory, `.expect("buffer JSCell type cannot change after coercion")` would be the 

This second assertion doesn't actually verify the buffer-before-offset ordering: with a string `offset`, the pre-fix code also throws `TypeError`/`ERR_INVALID_ARG_TYPE` (for `"offset"`, via `validate_integer`'s `!value.is_number()` branch), so `toThrowWithCode` passes either way. To make it load-bearing, also assert the message contains `'"buffer"'` like the first case does, or use a numeric out-of-range offset so the pre-fix code differs.