Add list_insert_at and list_slice builtins (#544)

[Nitjsefnie]

Closes #544.

Adds the two missing C-backed list builtins so reorder and range-copy no longer go through interpreter-speed hand-rolled loops:

• list_insert_at of [list, i, v] — dual of list_remove_at. Inserts v at index i, shifting the tail up. i == count appends; any other out-of-bounds index is a no-op returning the list (matching list_remove_at's lenient behaviour).
• list_slice of [list, start, end] — dual of copy_into. Returns a new list with elements [start, end). Negative indices count from the end (the at_index/get_at / set_at / char_at silently ignore negative indices, diverging from the [] operator's documented negative indexing #312 policy used by get_at/set_at/[]); both bounds clamp to [0, len]; start >= end → []; never raises on bounds (per the issue's list_slice of [[1,2], 5, 9] → []). Malformed args return null, mirroring copy_into. Charges the new slots via sandbox_charge like concat (sandbox_run has no memory budget: generated 'zeros'/aggregate allocation aborts the host (uncatchable) #292).

Both are registered next to their duals in register_builtins, added to SANDBOX_ALLOW (both duals were already there — same membership rule: pure, touches only handed-in values), and documented in docs/BUILTINS.md (required by tools/stdlib_index_check.sh).

One C detail worth a glance: the middle-insert path grows the array by appending the old last element (reusing list_append's capacity/arena handling), then memmoves the tail up. Since list_append increfs, the old last element would otherwise be left with one unbalanced reference after the memmove overwrites its original slot — so there's an explicit val_decref(old_last) afterwards to keep its refcount matched to its single remaining slot (it still occupies slot[count] at that point, so the decref can't free it). Net: the inserted value gains one reference, every existing element keeps exactly one.

Tests: tests/test_list_insert_at.eigs and tests/test_list_slice.eigs mirror test_list_remove_at.eigs (insert middle/start/end/out-of-bounds; slice normal/empty/full/clamped) — plus a repeated-middle-insert stress case that also guards the refcount path. Full suite: 3118/3118 passed.

---

Generated by Claude Opus 4.8 (brief, review), Kimi K3 (implementation)