inspect: harden model component window bounds

modelComponentsMatch already calls componentsEqualAt only for offsets whose matched span is in bounds, but add a defensive bounds check inside componentsEqualAt so direct or future callers cannot overrun the long slice. Add a focused regression test for negative and overrun offsets.