GHSA-7v4j-8wvr-v55r: `array!` macro is unsound when its length is impure constant

The vulnerability stemmed from dual use of $count in:

1. __ArrayVec type parameter initialization (<_, {$count}>)
2. Loop condition (while vec.0.len < $count)

Before the patch, both positions would re-evaluate the $count expression. The commit fixed this by introducing a __Capacity struct to capture N once via vec.0.capacity.get(), ensuring single evaluation. The vulnerable code path is clearly the macro's loop condition logic prior to this fix, as confirmed by the patch changing 'while vec.0.len < $count' to use the capacity field.