[endrebak]

Transcript projection can extrapolate outside an exon: query [-5,5) against local exon [0,10) / genomic [100,110) returns [95,105). It also silently assumes both input tables are sorted, which prevents callers from safely passing their original row order.

Clip both query boundaries to each exon and omit empty intersections. Sort numeric query/exon row permutations in the core only when needed, keeping already-sorted inputs on the allocation-free permutation path. Both projection APIs retain original query and annotation indices; sort_output=true restores their original row order. This gives the NumPy and Polaranges callers one implementation of sorting and clipping. Exon local spans remain required to be non-overlapping within each transcript.

Bump the crate, lockfile, and changelog to 0.1.16. The dependent NumPy PR #45 and PyRanges1 PR #211 require this version before enabling the Rust mapping path.

Validation:

• All 78 existing Rust tests pass (cargo test --offline).
• A temporary development harness outside the repository checks 2,000 randomized i32/i64 projections against independent exon intersections, with separately shuffled query/exon inputs, local gaps, negative/out-of-bounds queries, original-row attribution, and both output-order modes. The four- and five-array APIs agree.
• A release ABI3 NumPy wheel using this core passes 73 checks on Python 3.12, 3.13, and 3.14 with NumPy 2.5.4, and Python 3.12 with NumPy 1.26.4.
• The downstream Rust-backed PyRanges1 mapping passes 860 existing unit tests and 111 doctests, plus exact pandas comparisons of coordinates, index/order, dtypes, strand composition, negative offsets, and metadata.
• rustfmt --check src/map_to_global.rs and git diff --check pass. Repository-wide formatting still reports an existing src/ranks.rs difference; strict Clippy still fails on existing crate-wide diagnostics. Normal cargo clippy --all-targets succeeds with those warnings.

No repository unit tests were added or modified in this core PR; the additional development checks were kept outside the repository.