fix: bound array insert/fill/slice indices and reject diverging security symbol rebinds

[luisleo526]

Two independent fail-closed guards

1. Array index bounds — array.insert, 3-arg array.fill, array.slice

Pine treats an array index as a checked value: an index outside the array raises
a runtime error that halts the script. The valid domain depends on the operation's
role, not one rule — element access is valid over [0, size), an insertion point
is valid over [0, size] because inserting at size appends, and a half-open
[index_from, index_to) endpoint is valid over [0, size] because index_to is
exclusive. insert additionally inherits end-relative negative indexing (the
reference lists it with get/set/remove); fill and slice do not.

These three lowerings had erased that role distinction into an unchecked (int)
cast, so an invalid Pine index became C++ undefined behaviour instead of a
diagnosable Pine error. Demonstrated on a built engine, not theorised:

• array.insert(a, -1, v) silently wrote the wrong slot and returned a wrong value
  with no diagnostic;
• an out-of-range slice/fill SIGBUS'd the process.

They now route through the existing checked-index machinery that already backs
get/set/remove/first/last/pop/shift/percentrank, with deterministic
messages (Index 4 is out of bounds. Array size is 3, Index range 2..1 is invalid. Array size is 3).

Note array.slice has two emission sites — the typed-method lane and the
ARRAY_METHODS fallback. Guarding only the fallback would have left the live path
unchecked, so both use the checked helper and element types are preserved exactly.
Two pre-existing assertions that pinned the literal text of the unchecked slice
emission are retargeted at the checked lowering, keeping their original intent.

array.insert(a, size, v) (append) is preserved and pinned by three passing tests,
including one that links and runs a real binary — a naive < size bound would
have broken a live usage whose index is a binary_search_rightmost result.

2. request.security symbol — := rebind

In Pine a request.security symbol argument is a value, and the data loaded is
whatever it evaluates to at runtime. This engine can only load the chart symbol, so
the checker must prove the argument is the chart symbol under every reachable
evaluation. It read a variable's declaration while ignoring its := rebinds, so
var sym = syminfo.tickerid followed by sym := "EXCH:OTHER" passed — and since the
security registration carries no symbol, the result silently resolved to the chart
feed, producing plausible trades attributed to a symbol never loaded.

Rebinds (including compound-assignment forms) are now recorded and a divergent rebind
is rejected.

Deliberately NOT included

The sibling hole — accepting a ternary symbol when either branch is the chart
symbol — is held back on a separate branch. Tightening it would reject a
currently-correct strategy whose declared input configuration provably selects the
chart-symbol branch, deleting a 100 %-matching row from the graded set. That is a
worse immediate error than an unexercised hole.

Refining it to "reject only when the divergent branch is selectable at the compiled
configuration" was investigated and is unsound: the checker can see input
defaults but not overrides, which resolve at runtime, so folding defaults would leave
the hole reachable while looking fixed. Threading configuration into the transpiler
would change its contract from source -> C++ to (source, config) -> C++ and break
the determinism every byte-identity gate depends on.

The sound fix is to thread the resolved symbol into security registration and reject
at runtime; that touches a public signature and belongs in its own change.

Gates

• RED first: 22 of 30 new array checks failed at the base commit, including the two
  runtime probes (wrong-slot write; SIGBUS). All 4 rebind checks failed. Positive
  controls passed before and after.
• Full suite 2552 -> 2586 passed / 1 skipped — delta exactly the 34 new tests, no
  other movement. (Requires the Eigen include; without it 801 tests silently skip.)
• Exposure differential over 788 sources (validation corpus + private set),
  base vs patched: success_set_changed: 0, failure_message_changed: 0, and
  exactly 3 sources' emitted C++ changed — all array.insert/array.slice
  users, diffs purely the guard wrapper replacing raw iterator arithmetic, all still
  compiling clean.

Residuals recorded in docs/codegen-coverage-gaps.md

• array.slice aliasing: the reference says a slice shares storage with its source,
  while both lowerings deep-copy. Needs a view type; the doc wording ("an object from
  the slice") does not settle element-for-element aliasing for arrays of primitives,
  so that must be pinned before designing it.
• Inverted ranges are rejected rather than clamped to empty; negative fill/slice
  endpoints are rejected — both fail-closed choices with no evidence pinning
  TradingView's behaviour.
• The rebind table is keyed by bare name with no scope resolution, mirroring the
  existing declaration table; a divergent rebind of a local could disqualify an
  unrelated global. Fail-closed, and the 788-source differential shows it costs
  nothing today.