Operand-size-prefixed (0x66) relative branches are classified as having
no branch target, so the AdjustedDelta check never saw them. The
truncated-branch guard only checked whether the branch and its target
move apart, so `66 EB 01 B8 11 22 33 44 C3` rewritten at offset 3 was
accepted and the branch landed in the middle of the new bytes.
Reject a truncated branch whose target is inside the cut, and run that
check for same-length rewrites too, matching the rel8/rel32 path.