types: Height::decrement_by never returns None on underflow

[Ruzzgar]

Problem

Height::decrement_by (crates/types/src/height.rs) returns Option<Self> but wraps saturating_sub in Some, so it never returns None — decrement_by(n) for n > height yields Some(Height(0)):

fn decrement_by(&self, n: u64) -> Option<Self> {
    Some(Self(self.0.saturating_sub(n)))
}

The malachitebft Height trait documents this method as "Returns None if the height would be decremented below its minimum", and the same type's inherent decrement() already uses checked_sub. Since the trait's default decrement() delegates to decrement_by, the trait and inherent decrement() disagree at the zero boundary.

Proposed fix

Use checked_sub, matching the contract and the inherent decrement(). All call sites go through unwrap_or_default(), so behavior is unchanged. I have a patch with a test (fails on main, passes with the fix) ready once assigned.