audit I07 — variable-length logic opcodes asymmetric input clamp between integrity() and run()

[thedavidmeister]

From the March 2026 audit (commit `13917ea1`):

`LibOpAny`, `LibOpEvery`, and `LibOpConditions` clamp minimum inputs in `integrity()` to prevent zero-length processing:

```solidity
inputs = inputs > 0 ? inputs : 1;
```

The corresponding `run()` functions calculate stack lengths strictly from the raw operand bits without duplicating this clamp.

The central `integrityCheck2` loop prevents mismatch from reaching execution via `BadOpInputsLength`, but the safety guarantee is in a distant generic location rather than co-located with the opcode logic. Latent structural fragility: if the central check were relaxed, a `run()` executing with zero inputs would shift the stack top down without popping items, pushing uninitialized EVM memory as output.

Path: `src/lib/op/logic/LibOpAny.sol`, `src/lib/op/logic/LibOpEvery.sol`, `src/lib/op/logic/LibOpConditions.sol`

Fix: duplicate the minimum-input clamp inside each `run()` before computing the stack-length variable. Execution then respects the same validation bounds independent of any external check loop.

[thedavidmeister]

Not actionable as described. The 'clamp' pattern in integrity() is the integrity-time error mechanism, not a value transformation. integrity() returns the opcode's minimum-required inputs (1 for any/every, 2 for conditions). The parser separately encodes the operand-declared inputs into the bytecode prefix. The central integrityCheck2 then asserts calcOpInputs == bytecodeOpInputs — if the operand declared fewer inputs than the minimum, the return value diverges from the bytecode prefix and BadOpInputsLength fires. The behaviour is pinned by testOpAnyEvalFail (BadOpInputsLength(0, 1, 0)), testOpEveryEvalFail (BadOpInputsLength(0, 1, 0)), testOpConditionsEvalFail0Inputs (BadOpInputsLength(0, 2, 0)), and testOpConditionsEvalFail1Inputs (BadOpInputsLength(0, 2, 1)). The audit-proposed run-side duplication doesn't add safety — bytecode that would hit the bad run() path can't pass integrityCheck2, which is the entry point for every execution path.