Improve RangeOps::Merge (#129390)

Fold more bound checks with up to -110k
[diffs](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1463553&view=ms.vss-build-web.run-extensions-tab)

RangeOps::Merge is typically used when we merge ranges from PHI args,
e,g, `[0..1] U [10..10]` becomes` [0..10]`

> [!NOTE]
> This PR was authored with assistance from GitHub Copilot CLI (AI). The
change was validated locally via SuperPMI asmdiffs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EgorBo

src/coreclr/jit/rangecheck.h

@@ -616,23 +616,27 @@ struct RangeOps
         // and we have to be careful by not masking possible overflows.
 
         // Widen Upper Limit => Max(k, ($bnd + n)) yields ($bnd + n),
-        // This is correct if k >= 0 and n >= k, since $bnd always >= 0
+        // This is correct if n >= k, since $bnd always >= 0 (so $bnd + n >= n >= k).
         // ($bnd + n) could overflow, but the result ($bnd + n) also
         // preserves the overflow.
         //
-        if (r1hi.IsConstant() && r1hi.GetConstant() >= 0 && r2hi.IsBinOpArray() &&
-            r2hi.GetConstant() >= r1hi.GetConstant())
+        if (r1hi.IsConstant() && r2hi.IsBinOpArray() && r2hi.GetConstant() >= r1hi.GetConstant())
         {
             result.uLimit = r2hi;
         }
-        if (r2hi.IsConstant() && r2hi.GetConstant() >= 0 && r1hi.IsBinOpArray() &&
-            r1hi.GetConstant() >= r2hi.GetConstant())
+        if (r2hi.IsConstant() && r1hi.IsBinOpArray() && r1hi.GetConstant() >= r2hi.GetConstant())
         {
             result.uLimit = r1hi;
         }
 
         // Rule: <$bnd + cns1, ...> U <cns2, ...> = <min(cns1, cns2), ...> when cns1 <= 0
         //
+        // $bnd is always >= 0, so when cns1 <= 0 the expression ($bnd + cns1) cannot overflow and
+        // its smallest value is exactly cns1, making min(cns1, cns2) a sound lower bound. We must
+        // keep the cns1 <= 0 guard: for cns1 > 0, ($bnd + cns1) can overflow (e.g. a Span length is
+        // bounded by INT_MAX, so $bnd + 1 may wrap to INT_MIN), which would make the collapsed
+        // constant an unsound (too-high) lower bound.
+        //
         // Example: <$bnd - 3, ...> U <0, ...> = <-3, ...>
         //
         if (r1lo.IsBinOpArray() && r2lo.IsConstant() && (r1lo.cns <= 0))