fix: handle negative indices in array slice

[cs01]

Summary

• arr.slice(0, -1), arr.slice(-2), etc. now work correctly for number[], string[], and object[] arrays
• Previously, negative indices were passed directly to fptosi → i32 without adjustment, producing wrong results
• Added normalizeSliceIndex() helper that matches string slice behavior: detect negative → add length → clamp to [0, len]
• Also clamps final slice length to ≥0 to prevent negative-length memcpy

Test plan

• Added tests/fixtures/arrays/array-slice-negative.ts covering negative start, negative end, and both for number[] and string[]
• All 434 tests pass (433 existing + 1 new)
• Self-hosting verification passes (Stage 0 + Stage 1)

🤖 Generated with Claude Code