#29024 base red: panic ratchet: cmux-rd-link's 7, acpmux's and cmux-tui's new index/slice hits

What

A base red, priority zero. The Rust panic ratchet (scripts/ci/cmux-tui-rust-check.sh panic, the "Rust panic ratchet" step of cmux-tui.yml) is red on feat-cmux-next on three rows. Every PR that touches cmux-tui inherits it.

• cmux-rd-link: clippy::indexing_slicing 7 > new crate (must be 0): the new crate landed by direct push (3b9cf69de2a6, 6d04ce13d3d6, ae8cd21c3ef5).
• acpmux: clippy::indexing_slicing 692 > baseline 686: from #28170.
• cmux-tui: clippy::indexing_slicing 836 > baseline 831: from 49394d0d (group create), cf3d7a39 (chief acp/pipe), d13d17ac (apps info) and 7b3b9f7886a (cmux automation --target cloud).

Fix

Each hit is rewritten with checked access, as #28808 and #28847 did. The baseline is not raised and no allow is added. No behavior change: where the old code would have panicked, the new code gives an empty slice, a null or no match.

• cmux-rd-link lib.rs: write_handshake truncates the buffer to the length Noise wrote; seal builds the packet with push/extend_from_slice/resize and gives Noise the body through get_mut(9..).
• cmux-rd-link replay.rs: the window word goes through get/get_mut. slot() always gives a word < WORDS.
• acpmux host_peering.rs, hub/peers.rs, server/requests.rs: Value indexing becomes pointer/get and JsonSet::set.
• cmux-tui group_create.rs, chief/mod.rs, chief/pipe.rs: get(n..).unwrap_or_default(). apps_list.rs: get(..).and_then(..).
• cmux-tui cli/automation.rs take_target: it walks the words with an iterator. A new unit test pins both flag forms, the default, a missing value and a bad target.

The rd-link, acpmux and four cmux-tui hunks are Leo's from #28958 (credited with Co-authored-by; his unused-import fix dc34d45b4e is cherry-picked with his authorship). The take_target hit came after his count.

Verification

• Check: cmux-ci run --class isolated --script scripts/ci/cmux-tui-rust-check.sh --arg panic --ref <sha>, and --arg clippy (the -D warnings step).
• Red on the base: feat tip 0779a9459c5a, job 8f6fbb89e758f20f49b7d372 (https://github.com/manaflow-ai/cmuxterm-hq/actions/runs/41171975318): cmux-rd-link 7 > new crate, cmux-tui 835 > 831. At 19b8aaa8 over a newer base, also acpmux 692 > 686, cmux-tui 836 > 831 (job 4c51f42f48fd71e5cc9cb947).
• Head 467388d5: panic ratchet green (job f8235b86838f87ac3b080fd3, https://github.com/manaflow-ai/cmuxterm-hq/actions/runs/41179291058). Head 2d634ba8 (unused import removed): panic and clippy results follow in a comment.

Observed / Not run

• Observed: the ratchet red on the base and green at 467388d5. prepush-gate.py: no new violations. Tests at 467388d5 (job c285412e8b48acf834fcdfd0): 13508 of 13519 passed. The cmux-rd-link tests and the new take_target test passed. 11 tests failed in acpmux peer_restart/startup_load, cmux-tui cli_audit/setup/apps_store and cmux-tui-core local_resize_order. None of them is in the changed code.
• Not run: the 11 failing tests on the base, so I did not prove that they are base reds. No Mac build (Rust only, Linux ratchet).

Changelog

none