Challenge 3: Safe Signature, Unsafe Implementation — Possible Solution
====================================================================

split_at_mut's PUBLIC SIGNATURE — something like fn split_at_mut(&mut self, mid: usize) -> (&mut [T], &mut [T]) —
contains no unsafe keyword at all, and callers can invoke it from
ordinary safe code with no unsafe block of their own required. This is
possible because the FUNCTION'S AUTHOR has already done the work of
manually verifying that, despite what the implementation does
internally, the function as a WHOLE upholds all of Rust's normal
safety guarantees for any valid inputs — no aliased mutable references
ever actually escape to the caller, even though achieving that
required unsafe raw-pointer manipulation internally that the borrow
checker alone couldn't have verified.

WHY THE BORROW CHECKER CAN'T EXPRESS THIS DIRECTLY: splitting a slice
into two mutable halves at a midpoint genuinely produces two
non-overlapping regions of memory — but expressed as ordinary Rust
code (e.g. two separate &mut self.array[..mid] and &mut
self.array[mid..] borrows), the borrow checker sees TWO mutable
borrows of the SAME slice active simultaneously and rejects it,
because it can't reason about the fact that they don't actually
overlap — it only knows the general rule (one mutable OR many
immutable, Course 1 Chapter 4), not this SPECIFIC geometric fact about
array splitting.

THE OBLIGATION THIS PLACES ON THE IMPLEMENTER: because callers get NO
compiler-verified guarantee about what happens INSIDE an unsafe block
— that's the whole point of the keyword — the person writing the
implementation takes on FULL personal responsibility for manually
proving every safety invariant that would normally be checked
automatically. Getting this wrong doesn't just produce a bug the
compiler will catch later; it produces genuine undefined behavior that
compiles cleanly and may only manifest as a crash or memory corruption
much later, somewhere far removed from the actual mistake — precisely
the elevated stakes this chapter's own warn-box described.