fix: add bounds checking to charAt and charCodeAt

[cs01]

Summary

• charAt and charCodeAt had no bounds checking — negative or out-of-bounds indices would read unowned memory (potential crash/security issue)
• now checks index >= 0 && index < strlen(str) before accessing
• out-of-bounds charAt returns empty string, charCodeAt returns 0 (matching JS semantics)

Test plan

• new test: strings/string-charat-bounds.ts — validates in-bounds and OOB behavior
• verify:quick passes (tests + stage 1 self-hosting)

🤖 Generated with Claude Code