Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/capi/src/bytesobject.rs`:
- Around line 10-26: Validate that the incoming len is non-negative at the start
of PyBytes_FromStringAndSize and bail out immediately if it's negative: check if
len < 0, set an appropriate Python exception (e.g., raise ValueError or call the
existing C-API error setter) on the VM, and return NULL instead of converting
len to usize; only after this check convert len to usize and proceed with the
current branches that allocate or slice using that usize value (refer to
function PyBytes_FromStringAndSize and the branches that call
Vec::with_capacity/set_len and slice::from_raw_parts).

In `@crates/capi/src/unicodeobject.rs`:
- Around line 108-126: The function PyUnicode_EqualToUTF8AndSize uses
slice::from_raw_parts with size cast unsafely, which overflows when size is
negative; add a guard at the start of PyUnicode_EqualToUTF8AndSize that checks
if size < 0 and immediately returns false (0) via the with_vm/Ok(false) path (or
direct c_int 0) to avoid creating an oversized slice, then proceed with the
existing logic (locate the unicode downcast to PyStr and the slice/from_utf8
steps) only when size is non-negative.