`removeCells`, `insertCells`, and `dispose` each iterate over
`_anchors` while invoking `anchor.dispose()` on entries inside the
loop — but `dispose()` removes the anchor from the same list, which
shifts later indexes left and causes the for-loop to skip them.
Symptoms (no user-facing report yet, but real correctness bug):
- After `removeCells` with multiple anchors past the start, anchors
that should be repositioned were silently left at their old `x`.
- After `insertCells` with anchors getting pushed past `_length`,
ones meant to be disposed could survive.
- `BufferLine.dispose` would throw `ConcurrentModificationError` as
soon as more than one anchor was attached.
Fix: iterate `_anchors.toList()` (a snapshot) in all three sites.
Cheap, safe, and matches the expected anchor-management semantics.
Surfaced by the unit tests added under T-91; that commit covers the
fix with regression tests.
Co-Authored-By: Claude <noreply@anthropic.com>