validate paired array lengths in pipeline deserializer

[soma0212]

Malformed pipeline input can drive an out-of-bounds access in the deserializer, which runs no verifier on the incoming buffer (GetPipeline just casts the bytes).

• Several loops index one serialized array by another array's length without checking they match; the serializer writes each pair in lockstep, so valid .hlpipe files are fine, but a crafted file can declare mismatched counts
• The funcs loop is the worst case: functions[] is sized from func_names_in_order, while the loop bound is the independent funcs() vector length, so a larger func count hands deserialize_function an out-of-bounds Function reference that update_with_deserialization then writes into
• deserialize_expr_vector (expr types vs values), the requirements loop (type vs value), deserialize_fuse_loop_level (dimension names vs strategies), and deserialize_buffer (dimensions scalar vs dims() length) share the same shape
• Each site now checks the lengths agree, so a mismatch is rejected with a clear error instead of indexing past the end

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[alexreinking]

Thanks for the patch!

[codecov]

Codecov Report

❌ Patch coverage is 20.00000% with 4 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@10162e8). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/Deserialization.cpp	20.00%	0 Missing and 4 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9211   +/-   ##
=======================================
  Coverage        ?   69.86%           
=======================================
  Files           ?      255           
  Lines           ?    78528           
  Branches        ?    18779           
=======================================
  Hits            ?    54863           
  Misses          ?    18154           
  Partials        ?     5511           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.