Close the out-of-bounds hole in ReadBytes/WriteBytes

[CoreyRDean]

Non-technical summary

ReadBytes/WriteBytes (which transfer raw bytes between a memory bank and a file/socket stream) trusted the byte count you handed them. A negative count — or a negative offset with a compensating count — slipped past the single bounds check and drove an out-of-bounds memory read/write from ordinary Blitz code: an arbitrary read/write primitive. This PR closes that hole using the same guard pattern the project already applied to CopyBank. Advances INTENT's "no silent corruption — bounds checks always worth doing."

Technical summary

bbReadBytes/bbWriteBytes in src/blitzrc/bbruntime/bbbank.cpp validated only the composite debugBank(b, offset+count-1) index — no count<=0 guard, no independent start-offset check:

• ReadBytes(bank, s, 10, -5) → composite index 4 is in range → passes → s->read(data+10, -5); the negative count widens to a huge std::streamsize → massive OOB write into the bank.
• ReadBytes(bank, s, -100, 200) → composite index 99 is in range → passes → reads into data-100 → OOB underflow.

bbCopyBank (Round-4 audit) already fixed this exact class with if(count<=0) return; + independent start and end debugBank checks. ReadBytes/WriteBytes were the unfinished tail (they still carried the old dead //if(debug){ scaffolding). This PR mirrors CopyBank's guards in both functions and removes the dead comments. In debug builds a bad index raises a clean Blitz RuntimeError; otherwise the call no-ops and returns 0. Valid positive, in-range calls are byte-identical.

Acceptance criteria + results

• WriteBytes/ReadBytes with count <= 0 return 0 without touching the stream — verified: WriteBytes(..., -1) leaves the output FileSize = 0; ReadBytes(..., -1) leaves a sentinel-filled bank unchanged; both blocks complete (no crash) — the regression guard, since pre-fix the negative count drove an OOB transfer.
• Happy-path round-trip (bank → file via WriteBytes, file → bank via ReadBytes) reproduces the bytes exactly.
• Existing BankBoundsTest.bb (CopyBank) + full test.bat green; local build 0 errors; corpus sweep unaffected.

Trade-offs, deferred follow-ups

• Pile-on note (disclosed): the prior iteration (Bounds-check the BBList API: bad indices fail cleanly instead of via UB #73) was BBList bounds-checking; this is another bounds fix. I weighed the loop's anti-pile-on bias and chose impact — a reachable arbitrary OOB read/write outranks the heuristic, and this is a different module/function family completing a committed audit. Next iteration will deliberately steer to a different area (diagnostics/DevEx).
• Out of scope: defense-in-depth negative-size guards inside bbStream::read/write; CopyBank/Peek/Poke (already correct).
• Deferred (confirmed): seTranslator missing-break (mislabels native crashes); human-readable compiler diagnostics (source line + caret, blitzide-gated); qstreambuf new[]/delete mismatch (stdutil.cpp).

🤖 Generated with Claude Code