fix(codegen): enforce checked array access semantics

[luisleo526]

Summary

• enforce Pine v6 checked bounds for array.get/set/remove, including valid negative indices
• raise deterministic runtime errors for out-of-range access and empty first/last/pop/shift
• preserve Pine evaluation order and one-evaluation semantics, including eager set value evaluation before an error
• preserve UDT write-through aliases for stable array lvalues while returning safe values from temporary receivers
• support checked methods through keyword arguments, user-function/matrix-row temporaries, nested arrays, and ternary array receivers

Masking bugs closed

The checked-access change exposed two older bugs that would otherwise have hidden regressions:

1. a temporary array<UDT> was incorrectly classified as aliasable and generated a non-const reference to a temporary;
2. narrowing that alias rule initially broke write-through for nested array<array<UDT>> access.

Both paths now have compile-and-run controls. The tests also cover local/global na indices, infinity before integer conversion, vector<bool> proxies, C++ runtime error propagation, and post-error statement suppression.

Validation

• 1690 passed, 2 skipped (full engine-enabled pytest suite)
• focused checked-access/UDT suite green
• UBSan error matrix green for OOB, empty, local/global na, and infinity
• native/Pyodide differential gate: 277/277 (263 success + 14 expected-error fixtures)
• engine corpus compile: 254/254
• full source differential against f2f14882: data 522 OK + same 17 errors; corpus 254/254 OK; no status or error-text transitions
• changed-output set equals the checked-method consumer set exactly: data 92/92; corpus 11/11
• authoritative no-cache gate for all 71 runnable standard consumers: 71/71 status ok, empty last_error, 59E / 10S / 1M / 1W, no tier downgrade
• fresh direct tape comparison: all 11 corpus consumers byte-identical to f2f baseline, with empty last_error

Tested commit: 9b08d9edb7e76b5e70809848cd19d83f13c1f5bd
Tested tree: 3edc870a712a1a84e821b6b8641fee30b5a6cd08

Runtime provenance for the corpus tape gate: engine test head 060eb4cd tree 471c83f4, identical to public origin/main fde4f147 tree 471c83f4; freshly built library SHA-256 72f3840574bd81b25d4741f7eed3607adcaea5a168869bac5b82ded31ceff780.

B3ar bug-masking exception

70 of the 71 standard tapes are byte-identical to the frozen accepted tapes. The sole intentional structural change is b3ar-trades-ehlers-dominant-cycle-stochastic-rsi-v2 (Weak -> Weak):

• a 2x2 factor matrix isolates the change to checked get; checked pop is tape-neutral
• at lag == maxPeriod, n == 0, and Pine's descending loop visits i = 0 then i = -1
• the old raw lowering converts -1 to a C++ vector index and ASan reports a heap-buffer-overflow exactly 8 bytes before filtBuffer
• the checked lowering applies Pine v6's valid -1 normalization to the final element and completes cleanly under ASan/UBSan
• both raw and checked tapes are stable across -O0, -O1, -O2, and -O1 -ffp-contract=off, ruling out stack-layout/optimizer noise

The accepted raw tape is therefore a bug-masking UB artifact, not a valid no-regression oracle for this path. No promotion is claimed.

Campaign impact and residuals

This is expected to be score-neutral: the current corpus has no proven live negative-index execution, so no tier promotion is claimed without a TradingView oracle. Follow-up KI-48 scope remains explicit for checked insert/fill/slice ranges, array.percentrank bounds, mixed-na calculations, and broader collection/UDT reference-identity architecture.