fix: clamp negative deletecount in splice, fix assert.notequal nan (#266)

[cs01]

Summary

• arr.splice(i, -1) with negative deleteCount was passed through as-is, then zext i32 -1 to i64 produced 0xFFFFFFFF (4GB), causing massive memcpy and memory corruption. Now clamped to 0.
• Also changed zext to sext for splice size calculations (safety against any remaining negative edge cases)
• Fixed assert.notEqual using fcmp one instead of fcmp une — assert.notEqual(NaN, NaN) incorrectly failed because one returns false when either operand is NaN

Test plan

• npm run verify:quick passes (tests + Stage 1 self-hosting)
• New test: arrays/splice-negative-deletecount.ts — splice with -1, 0, positive, and negative start

🤖 Generated with Claude Code