std.removeAt crashes (INTERNAL ERROR) on out-of-bounds index

## Description

`std.removeAt` crashes with an internal panic instead of reporting a regular runtime error when the index is out of bounds, for both positive and negative indices.

## Reproduction

```jsonnet
std.removeAt([1, 2, 3], 5)
```

Actual (go-jsonnet v0.22.0, Homebrew CLI):

```
INTERNAL ERROR: (CRASH) runtime error: slice bounds out of range [:5] with capacity 3
goroutine 1 [running]:
runtime/debug.Stack()
runtime/debug/stack.go:26 +0x64
github.com/google/go-jsonnet.(*VM).Evaluate.func1()
github.com/google/go-jsonnet/vm.go:193 +0x34
...
github.com/google/go-jsonnet.builtinRemoveAt(...)
```

Same crash with a negative index:

```jsonnet
std.removeAt([1, 2, 3], -1)
```

```
INTERNAL ERROR: (CRASH) runtime error: slice bounds out of range [:-1]
```

## Expected

A regular runtime error consistent with the bounds errors used elsewhere, e.g. what plain indexing reports for the same indices:

```
RUNTIME ERROR: Index 5 out of bounds, not within [0, 3)
```

## Notes

- sjsonnet reports a clean runtime error for both cases (`idx 5 out of bounds, array length 3`).
- Found while differential-testing sjsonnet against go-jsonnet.

Start at the builtinRemoveAt entry point shown in the stack trace and inspect the call around vm.go:193. Reproduce the positive and negative out-of-bounds cases, then verify that both report regular runtime errors matching the existing bounds-error style rather than an internal panic.

Written by the indexing model from the issue text.