Bounds-check the BBList API: bad indices fail cleanly instead of via UB

[CoreyRDean]

Non-technical summary

BBList (the modern dynamic-list type, used heavily by rcce2) trusted whatever index you handed it. Pass an out-of-range or negative index — or call ListFirst/ListLast on an empty list — and the runtime hit undefined behaviour / heap corruption, or in the case of ListAt, killed the entire program with an opaque C++ error. This PR adds bounds checks so bad indices fail cleanly: a clear runtime error in debug builds, a safe no-op otherwise — never memory corruption. Advances INTENT value #6 ("Trust the runtime").

Technical summary

In src/blitzrc/bbruntime/basic.cpp, the _bbVector* functions did no validation:

• ListInsert/ListRemove/ListReplace → begin()+idx with no range check (invalid iterator → UB).
• ListFirst/ListLast → front()/back() on a possibly-empty vector (UB).
• ListAt → vec.at(idx), whose std::out_of_range escaped to the top-level bbruntime_run catch and terminated the whole program with an STL string.

Added two inline guards — listIndexOk() and listNotEmpty() — mirroring the established bank/stream idiom (bbbank.cpp debugBank): debug ? RTEX(clean message) : errorLog + safe default. Applied to _bbVectorAt (now [] after the check), _bbVectorBack/_bbVectorFirst, _bbVectorRemove/_bbVectorReplace, and _bbVectorInsert (which correctly allows the append position idx == size and rejects idx > size). Happy-path behaviour is byte-identical. BBList is a BlitzForge-specific API, so there's no legacy-Blitz3D compatibility risk.

Acceptance criteria + results

• Out-of-range/negative ListAt returns Null and the program keeps running (pre-fix it crashed the whole run) — new testListAtOutOfRange.
• ListFirst/ListLast on an empty list return Null, no UB — testListFirstLastEmpty.
• Out-of-range ListRemove/ListReplace are no-ops, size + contents unchanged — testListRemoveReplaceOutOfRange.
• ListInsert accepts idx == ListSize (append) and rejects idx > ListSize / negative — testListInsertBoundary.
• All existing ListTest.bb happy-path blocks pass unmodified; full test.bat green; local build 0 errors; corpus sweep unaffected.

Note: the new tests run in -t mode where debug is false, so they exercise the soft-fail (no-op + safe default) path; the blocks completing is the regression guard, since the pre-fix ListAt out-of-range aborted the process. In a -d debug build the same inputs raise a clean Blitz RuntimeError.

Trade-offs, deferred follow-ups

• Negative-index "count from end" is a feature, not a fix — out of scope.
• _bbVectorClear arg-count/shadow quirk (basic.cpp:882: rtSym declares one arg, C fn takes two; inner for shadows the unused param) — harmless, pre-existing; flagged, not touched.
• Deferred (confirmed, next candidates): the seTranslator missing-break fix (bbruntime_dll.cpp — mislabels every native crash; verification path now known) and human-readable compiler diagnostics (source line + caret, sanitize EOF byte).

🤖 Generated with Claude Code