Allow checking for overflow without penalising fast path

Currently, to assert that addition doesn't overflow, we
```
add_cy(s, cy, a, b);
assert(digit::is_zero(cy));
```
If `NDEBUG` is not set, then this checks that overflow hasn't occurred. If `NDEBUG` is set, it's possible (need to verify) that some carry handling code is generated; this is wasteful as it isn't used.