Bounds-check HostIP() in release mode (close an out-of-bounds read)

[CoreyRDean]

Non-technical summary

HostIP() looks up a cached host IP address by index. It only checked that the index was valid in debug builds — so in a normal release build, HostIP(0) or an out-of-range index read past the end of the array (or before it), an out-of-bounds memory read that can crash or leak nearby memory into a Blitz integer. This fixes it to validate in all builds, returning 0 (and logging) for a bad index. Advances INTENT #6 ("trust the runtime").

Technical summary

bbHostIP(index) in src/blitzrc/bbruntime/bbsockets.cpp indexed std::vector<int> host_ips with a BASIC-supplied index, guarded by if(debug) only — release skipped the check and dereferenced host_ips[index-1] (UB: HostIP(0)→host_ips[-1], HostIP(big)→past the vector). This is the same debug-only-guard class already closed for banks (#73), ReadBytes/WriteBytes (#74/#75), and BBList; bbsockets.cpp was the unswept remainder. Now validated in both modes, mirroring the file's sibling helpers (debugUDPStream etc.): clean RuntimeError in debug, errorLog + return 0 in release. Valid-index path byte-identical. Windows runtime only (WSA-gated); no ABI change.

Acceptance criteria + results

• HostIP(0), HostIP(-1), HostIP(n>CountHostIPs()) return 0 (no OOB) in release/test mode; raise a clean error in debug.
• Valid HostIP(1..CountHostIPs()) unchanged.
• New tests/SocketTest.bb passes under blitzcc -t — and it's genuinely CI-reachable (the host-IP path needs no audio/graphics device, unlike most gxruntime code; it's offline-safe since an empty host_ips just makes every index out-of-range). Pre-fix, HostIP(0) in test mode was an OOB read; reaching the final assert is the regression guard.
• Full test.bat green; build 0 errors; corpus sweep unaffected.

Trade-offs, deferred follow-ups

• Not pile-on: this is the first bounds/release-guard fix in 5 iterations (recent work was diagnostics, contextual-keyword, GC docs, audio) — it completes the established debug-only-guard audit on the last unswept module (sockets).
• Deferred: contextual Release/Recast/Reference (legacy-compat Phase 2). Unlike Test, these are prefix operators in parseUniExpr (Release[.Type] <operand>), so making them contextual needs expression-position disambiguation (operand-follows = keyword vs operator/terminator-follows = identifier) — M-effort with real ambiguity risk (Release is GC-surface). Needs a focused feasibility pass.
• Deferred: gxSoundSample::load short-filename crash — real, but not reachable in headless -t (audio uninitialized), so no CI regression test; manual-only.
• Other Class B builtins; GC reference_map soundness; manual audible-pan check.

🤖 Generated with Claude Code