forms: address review feedback on range clamp

- Use std.fmt.allocPrint in formatFloat (per-review suggestion).
- Drop the `r3.value = '1' -> '1'` fractional-bounds assertion, which
  conflicted with WHATWG step matching (default step=1, base=min=0.5,
  nearest valid is '1.5'). Step matching remains out of scope here.

src/browser/tests/element/html/input-attrs.html

@@ -129,8 +129,10 @@
     testing.expectEqual('1.5', r3.value);
     r3.value = '0';
     testing.expectEqual('0.5', r3.value);
-    r3.value = '1';
-    testing.expectEqual('1', r3.value);
+    // Note: in-range pass-through under clamping alone is exercised by r1/r4.
+    // An assertion like `r3.value = '1' -> '1'` would conflict with WHATWG step
+    // matching (default step=1, base=min=0.5 -> nearest valid is '1.5'), which
+    // is intentionally out of scope for this PR; tracking separately.
 
     // Default min/max (0..100) when attributes absent
     const r4 = document.createElement('input');

src/browser/webapi/element/html/Input.zig

@@ -823,9 +823,7 @@ fn sanitizeRange(
 
 /// Format an f64 to its shortest decimal representation, arena-allocated.
 fn formatFloat(arena: std.mem.Allocator, value: f64) ![]const u8 {
-    var buf: [64]u8 = undefined;
-    const formatted = std.fmt.bufPrint(&buf, "{d}", .{value}) catch unreachable;
-    return arena.dupe(u8, formatted);
+    return std.fmt.allocPrint(arena, "{d}", .{value});
 }
 
 /// Parse a slice that must be ALL ASCII digits into a u32. Returns null if any non-digit or empty.