bug: out-of-bounds read in dedx_get_*_name / dedx_get_program_version on invalid id #110

Part of #108 (health-review epic).

Problem

The name/version accessors index static tables directly with the caller-supplied id and perform no bounds checking:

const char *dedx_get_program_name(int program)    { return dedx_program_table[program]; }
const char *dedx_get_program_version(int program)  { return dedx_program_version_table[program]; }
const char *dedx_get_material_name(int material)    { return dedx_material_table[material]; }
const char *dedx_get_ion_name(int ion)              { return dedx_ion_table[ion]; }

A negative or too-large id (e.g. an uninitialized/garbage program, or ion beyond the table) causes an out-of-bounds read and returns a junk pointer that the caller will dereference. This is reachable from user input via the WASM/Python bindings.

Expected

Invalid ids are handled safely (return a sentinel such as "unknown" / NULL, documented in the header) rather than reading out of bounds.

Proposed change

Add range validation against the table bounds in each accessor. Define the table lengths once (e.g. DEDX_PROGRAM_TABLE_LEN) so the checks can't drift from the data.

Acceptance criteria

• Each accessor validates its argument against the table size and returns a documented sentinel for out-of-range ids.
• Header docs state the behavior for invalid ids.
• A test passes negative, zero, and over-max ids to each accessor without invalid reads (verify under Valgrind/ASan).