Handle invalid negative dynamic-cost rows without extraction panics #70

Opened issue from Codex when investigating this PR: #67.

with-dynamic-cost creates i64 cost tables, while the current extraction cost type and documented policy require nonnegative costs. A computed set-cost value or direct cost-table write can therefore store a negative row that later reaches DynamicCostModel, where assert!(cost >= 0) panics.

Minimal reproductions, evaluated independently:

(with-dynamic-cost (datatype E (Num i64)))
(set-cost (Num 1) (- 0 1))
(extract (Num 1))

(with-dynamic-cost (datatype E (Num i64)))
(set (cost_table_Num 2) -1)
(extract (Num 2))

Follow-up work should ensure that extract, multi-extract, and keep-best never produce a Rust panic from these rows. The design should decide among write-time validation, an extraction error, ignoring invalid rows, or adopting signed costs.

Treating negative costs as valid rewards is tracked separately by egraphs-good/egglog-python#391 and egraphs-good/egglog#781.