Resolve UB in abs_diff with signed values

Subtracting a large positive signed value from a large negative signed
value can't be done in a signed value, as it will overflow.

Author: danakj

subspace/num/__private/intrinsics.h

@@ -674,6 +674,14 @@ sus_always_inline constexpr OverflowOut<T> sub_with_overflow_unsigned(
   };
 }
 
+/// SAFETY: Requires that `x > y` so the result will be positive.
+template <class T>
+  requires(std::is_integral_v<T> && std::is_signed_v<T>)
+sus_always_inline constexpr std::make_unsigned_t<T>
+sub_with_unsigned_positive_result(T x, T y) noexcept {
+  return unchecked_sub(into_unsigned(x), into_unsigned(y));
+}
+
 template <class T>
   requires(std::is_integral_v<T> && !std::is_signed_v<T> &&
            ::sus::mem::size_of<T>() <= 4)

subspace/num/__private/signed_integer_macros.h

@@ -666,12 +666,13 @@ class Tuple;
    * panics by returning an unsigned integer.                                 \
    */                                                                         \
   constexpr UnsignedT abs_diff(const T& r) const& noexcept {                  \
-    if (primitive_value >= r.primitive_value)                                 \
-      return __private::into_unsigned(                                        \
-          __private::unchecked_sub(primitive_value, r.primitive_value));      \
-    else                                                                      \
-      return __private::into_unsigned(                                        \
-          __private::unchecked_sub(r.primitive_value, primitive_value));      \
+    if (primitive_value >= r.primitive_value) {                               \
+      return __private::sub_with_unsigned_positive_result(primitive_value,    \
+                                                          r.primitive_value); \
+    } else {                                                                  \
+      return __private::sub_with_unsigned_positive_result(r.primitive_value,  \
+                                                          primitive_value);   \
+    }                                                                         \
   }                                                                           \
   static_assert(true)