CI: clang-tidy static analysis + flash-size budget gate

[TheAngryRaven]

PR #4 on the path to 8/10. CI tooling — no firmware behavior change.

1. clang-tidy static analysis

• .clang-tidy — enables the high-signal correctness families (bugprone-*, performance-*, portability-*, misc-*, clang-analyzer-*) with WarningsAsErrors: '*'. Deliberately skips the style/opinion checks (readability-*, cppcoreguidelines-*) that fight intentional embedded idioms — C arrays, pointer math, fixed magic constants — and would drown real findings in noise.
• HeaderFilterRegex: 'BirdsEye/.*\.h$' scopes diagnostics to our own headers. Verified locally: ~15k warnings from doctest/system headers are suppressed, leaving 0 in our code.
• .github/workflows/clang-tidy.yml — generates the test build's compile_commands.json (so clang-tidy gets each .cpp's exact flags) and analyzes the five host-buildable units: haversine, gps_time, gps_validation, dovex_header, filename_validator.

The only real finding was a true positive about an intentional choice: dovex_header.cpp's buffer builder does a non-null-terminated memcpy into the fixed 1024-byte region (it's \n-padded, not a C string). Suppressed inline with // NOLINT(bugprone-not-null-terminated-result) + a reason comment, so the check stays live everywhere else rather than being globally disabled.

Confirmed clang-tidy exits 0 locally on clang-tidy 18.

2. Flash-size budget gate

Added to compile-sketch.yml after the compile step. Parses the arduino/compile-sketches report and fails the build if flash usage exceeds 90% of the BSP-reported maximum.

Why absolute % and not a delta: the XIAO nRF52840's app flash is shared with the SoftDevice + bootloader, so the meaningful question is "will this still fit and leave OTA room," not "did it grow." Using absolute usage also means no base-branch checkout/compare is needed.

Robustness:

• handles both report schema variants (absolute as a bare number or as {current: N})
• degrades to a ::warning:: and passes if the report is missing or unparseable, so a schema change upstream can't wedge CI
• 90% threshold + FLASH_BUDGET_PERCENT env var so it's a one-line change to adjust

Validated the jq/awk logic locally against synthetic reports: a 30%-usage report passes at budget 90; a 93.7% report fails at 90 and passes at 95; an empty report warns-and-skips.

Badges

Fourth README badge (clang-tidy) joins compile-sketch, arduino-lint, unit-tests. CLAUDE.md CI line updated.

Notes / scope

• The .ino modules aren't clang-tidy'd — they need the full Arduino toolchain and are covered by compile-sketch. Static analysis here targets exactly the Arduino-free units, which is also where the testable logic lives.
• The 90% gate has generous headroom; this firmware is well under it. It's a runaway-growth tripwire, not a tight squeeze.

# reproduce locally
cmake -S tests -B tests/build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
clang-tidy -p tests/build BirdsEye/haversine.cpp BirdsEye/gps_time.cpp \
  BirdsEye/gps_validation.cpp BirdsEye/dovex_header.cpp BirdsEye/filename_validator.cpp

Where we are

#	Branch	Status
1	refactor/drop-legacy-module-headers	✅ merged (#32)
2	tests/host-doctest-harness	✅ merged (#33)
3	feat/ble-filename-sanitization	✅ merged (#34)
4	ci/clang-tidy-and-size-budget	← this PR
5	release/semver-and-uf2-artifacts	next
6	docs/contributor-setup	final

🤖 Generated with Claude Code

---

Generated by Claude Code