getCandidateInSeat is partial (uses Array.! with unenforced precondition)

[dnadales]

Problem

WFA.hs L383: uses Array.! with a documented but unenforced precondition.
Call-site asserts are compiled out with -O.

Proposed fix

Return Maybe or Either so callers can't forget the bounds check.

References

• ouroboros-consensus PR #1975 review r3131995056

[tbagrel1]

As indicated in Peras 23 comments, we:

• introduced the total getCandidateIfSeatsWithinBounds :: SeatIndex -> ExtWFAStakeDistr a -> Maybe (PoolId, a, LedgerStake, Cumulative LedgerStake)
• renamed the previous one unsafeGetCandidateInSeat
• the total one is used everywhere except in checkShouldVote ([1], [2]) where we use the unsafe one because we rely on the consistency invariant of the committee selection data structure (a seat indexed returned by the candidateSeats map should be part of the extWFAStakeDistr). If we used getCandidateIfSeatsWithinBounds here, we would have to deal with the impossible case with an error at call site.