Overhaul pre-commit hook and CI checks

[jserv]

This rewrites pre-commit hook from 7 basic checks to 11, adding compiler-based syntax verification, security pattern detection, and expanded banned function enforcement. All checks now operate on staged index content via a materialized temp tree.

New checks:

• Compiler -fsyntax-only pass (Linux only) with -Werror for format strings, implicit declarations, pointer type mismatches, and VLA
• Security pattern scan on newly-added lines: non-literal format strings, missing O_CLOEXEC, positive errno returns, unchecked malloc multiplication, unbounded scanf, thread-unsafe functions
• Expanded banned function list (13 functions)
• Whitespace error detection via git diff --check
• TODO/FIXME enforcement on new lines

Change-Id: Ic25657aaee3df44b155e92ae69e695c1c139f546

---

Summary by cubic

Overhauls pre-commit and CI gates to enforce formatting, whitespace, syntax, and security on C/H changes. Splits CI into fast coding-style and static-analysis jobs; adds Linux-only syntax checks and strengthens CLI/identity parsing with tests.

• New Features

  • Pre-commit (11 checks; skipped in CI): staged tree with headers + .config; clang-format-20; git diff --check; merge-conflict guard; non-ASCII path/name checks; binary warnings; TODO/FIXME on new lines; 13 banned functions; security scan on added lines (non-literal format strings, missing CLOEXEC, positive errno returns, unchecked malloc multiplication, unbounded scanf, thread-unsafe calls); compiler make check-syntax (-fsyntax-only, Linux only); cppcheck on changed files.
  • CI: new coding-style (trailing newline + clang-format-20) and static-analysis (banned funcs, secret patterns, dangerous preprocessor + cppcheck with timeout) jobs run in parallel with unit/build; adds .ci/check-*.sh scripts to enforce these.
  • Tooling: tighter .editorconfig; hooks resolve paths robustly, respect Git color.ui, and skip in CI.

• Bug Fixes

  • cli: reject out-of-range partition values (errno checked, UINT_MAX capped); adds unit tests.
  • identity: reject UID/GID that overflow target types; adds unit tests.

^{Written for commit 341cd08. Summary will update on new commits.}