Bytecode validators: bounds-check every callee signature before checking CALL ops

A common out-of-bounds bug in validators for untrusted bytecode or IR: the per-function pass checks a CALL op by using the callee's declared param/return slot numbers as indexes into the callee's temp or register table. Those numbers are range-checked later, in a separate loop over functions. A forward call (to a higher-indexed function) or a self-call reaches the indexing before the callee was validated, so a crafted file gives an attacker-chosen heap read, which ASan reports inside the validator. Fix: run a first pass that range-checks every function's signature (param/ret index < temp count, nonzero width), then validate the op bodies. Add red tests for both a forward CALL and a self CALL with an out-of-range slot; a test where callees always come first won't catch it.