[P2] Invalid array indices silently become valid writes #16

Reproduced during the 2026-09-04 language review at a20753c6cff96ee86758744e227a04460234a832. Priority: P2.

let a = [10, 20]
a[-1] = 99
a

Observed result: [99, 20], with no diagnostic. Reads with 0.9, -1, "x", and nil each return the first item.

ScriptValue::as_index casts numeric values and returns zero for unsupported types. Floating-point-to-integer conversion truncates fractions and saturates negative values to zero. Array indexing calls it without validating the operand. Splash's standard array helpers already perform more explicit index checks, so the core syntax and standard module have different contracts.

Validate finite, integral, nonnegative indices before accessing or mutating storage. If negative indexing is desired, specify and implement it deliberately; selecting zero is not a coherent negative-index policy. Invalid writes must leave the array unchanged. Prefer a checked conversion shared by indexing syntax and standard helpers.

Acceptance: implement the described correction, publish the resulting language contract, and add focused regression coverage including applicable capability, streaming-parser, and resource-limit cases.

Fix and executable regressions: PR #19. Workspace tests, explicit vendor suites, formatting, strict Clippy, and the Linux ARM64/RISC-V and Windows GNU compile checks pass locally. All GitHub Actions checks pass on f1e775f, including Linux tests, fuzzing, AddressSanitizer, and Miri. This issue remains open until the fix is merged.