ci: add mbo-style clang-tidy job + clear production clang-tidy findings (#166)

[helly25]

Adds a clang-tidy CI job mirroring helly25/mbo's, and clears the remaining production clang-tidy findings so the non-test tree is clean.

clang-tidy CI job (mbo-parity)

• Builds the compile DB in CI (compile_commands-update.sh, hermetic clang-22 - it records that clang so the commands are parseable by the matching clang-tidy), then runs the clang-tidy pre-commit hook.
• Scope: sources changed against main on a branch; the whole tree on main (clang-tidy is ~1 TU/50s, so branch runs stay fast).
• Cache: pulls LLVM each run (not cached, consistent with the sanitizer jobs); persists only a disk cache via a CI-written .bazelrc.user.
• Wired into the done gate. Report-only for now (continue-on-error on the lint step) while the ~100 test-file findings are swept; building the compile DB still gates (no job-level continue-on-error). Mirrors mbo, which is likewise report-only today.
• Drops mbo's "Build generated sources" step - xff has no generated headers.

Production findings cleared

• render.cc - hicpp-signed-bitwise x4: the unsigned char operand promotes to signed int before the hex shift/mask; cast to unsigned.
• content/line_match.h - drop the redundant {} on two string_view members.
• cli/plain_backend.cc - NOLINT modernize-return-braced-init-list (a braced {count, ' '} would list-initialize as initializer_list<char> - the std::string gotcha - not repeat the space).
• ignore/PatternList - NOLINT the deliberate STL-style empty()/size() accessor names.

Local: full //xff/... suite green (92); the four production files are clang-tidy-clean.

Remaining before the gate flip

The ~100 test-file findings (const-correctness, identifier-length/naming, cert-err33-c, unchecked-optional-access, argument-comment, etc.) are now surfaced by the report-only job. Sweeping them is the follow-up that lets us drop continue-on-error and make clang-tidy a hard gate.