unsafe-deep-dive: replace may_overflow with a real safety precondition

[rmyndharis]

The "Example: may_overflow" slide taught that signed integer overflow is
undefined behavior in release mode and that the function therefore needs
the unsafe keyword. Both claims are false: integer overflow is well
defined in Rust (debug builds panic, release builds wrap), and
a + i32::MAX does not require unsafe at all.

Replace the example with an unsafe fn element_at built on
slice::get_unchecked, which has a genuine safety precondition: the
caller must keep the index in bounds. This preserves the slide's purpose
(a concrete example of responsibility shifting to the programmer) and
leads directly into the "Safety Preconditions" segment. The speaker notes
state plainly that integer overflow is defined behavior and never requires
unsafe.

Closes #3122.