#28958 base red: panic ratchet: cmux-rd-link's 7 and cmux-tui's 5 new index/slice hits

HOLD: superseded by #29024 (merged as 0d38b5ce): it made the same panic-ratchet fixes, so this PR's diff against feat-cmux-next is now empty (head tree == base tree). Nothing left to land.

Base red fix (priority zero): the Rust panic ratchet is RED on feat-cmux-next at 3465552e:

• cmux-rd-link: clippy::indexing_slicing 7 > new crate (must be 0) (3b9cf69d, 6d04ce13, ae8cd21c)
• cmux-tui: clippy::indexing_slicing 835 > baseline 831 (49394d0d group create, cf3d7a39 chief acp/pipe, d13d17ac apps info)

It blocks area PRs such as #28757. #28808 and #28847 fixed the cmux-tui-core and apps hits; these are the rest.

Each hit is rewritten without a panic (get/get_mut, truncate, pushes into a Vec). The baseline is not raised.

• replay.rs: the slot word is always < WORDS, so get never misses.
• seal / write_handshake: n is at most the buffer handed to snow.
• cmux-tui: an empty-slice default replaces what would have panicked.

risk:low (no behaviour change).

Observed / Not run

• Observed: the ratchet on the tip (cmux-ci run 41169601379 on #28448) listed these 12 hit locations. A ratchet run at this head follows in a comment.
• Not run: cmux-rd-link and cmux-tui test suites (no behaviour change).

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code