Function safe_index 

pub fn safe_index(index: usize, size: usize) -> usize

Safe array index that clamps to zero under mis-speculation.

Returns index unchanged if index < size, or 0 otherwise. Uses bounds_mask internally for branchless operation.