feat(tools): C/C++ stdlib registry generator + Linux overlay

[shivasurya]

PR-01 of the C/C++ Phase 2 stdlib-resolution stack. Closes the 88% unresolved-call gap from Phase 1 by giving us a generator that walks installed system headers and emits per-header JSON manifests the loader (PR-02) will consume.

What's in this PR

• graph/callgraph/core/clike_stdlib_types.go — public schema (CStdlibRegistry, CStdlibManifest, CStdlibHeader, function/class/typedef/constant/param types). Stable contract between this PR's generator and PR-02's loader.
• tools/internal/clikeextract/ — new internal package, one concern per file:
  • walker.go — DiscoverHeaderSources(linux/c, linux/cpp), glibc/libstdc++ probing, deterministic header walk with bits//internal/ skip rules.
  • c_extractor.go, cpp_extractor.go — tree-sitter walkers reusing graph/clike helpers; C++ adds template-parameter capture, namespace-stack tracking, and a local findFunctionDeclarator that handles C++ reference_declarator (Phase 1's clike helper doesn't, blocking T&-returning methods like vector::operator[] / vector::at).
  • overlay.go — yaml.v3 loader + MergeOverlay with strict validation (language match, exactly-one-of function/method/typedef/constant, skip-rule shape).
  • emitter.go — per-header JSON write + sha256 checksums + deterministic manifest.json.
  • normalize.go — strip __attribute__, _GLIBCXX_*, _LIBCPP_*, canonicalize std::__cxx11:: → std::, SanitizeHeaderName.
  • extractor.go — Run() orchestrator (continue-on-parse-failure, mirrors goextract).
• tools/c_stdlib_overlay.yaml (28 entries) — security-critical sinks: format-string (printf family with __attribute__((format))), command-injection (system, popen, exec*), buffer-overflow (strcpy, gets, sprintf), allocation/tainted-source markers.
• tools/cpp_stdlib_overlay.yaml (55 entries) — STL methods whose template return types tree-sitter cannot substitute: vector / basic_string / unique_ptr / shared_ptr / optional / map / unordered_map; std::move, std::forward; throws annotations on at() / value().
• tools/generate_clike_stdlib_registry.go — thin //go:build cpf_generate_stdlib_registry entry-point wiring CLI flags into clikeextract.Extractor.

Why a separate clikeextract package (not flat in tools/)

Mirrors the existing tools/internal/goextract/ precedent — thin entry-point + heavy logic in an internal package, one file per concern, fully testable under regular go test ./.... The tech spec sketched everything flat in tools/; this layout is cleaner and consistent with the rest of the repo.

End-to-end smoke (this host's /usr/include + /usr/include/c++/13)

	Headers	Functions	Classes	Typedefs	Constants	Overlay
linux/c	1875	8467	—	1598	38270	27
linux/cpp	121	564	497	112	21	55

Both manifests parse round-trip. C output exceeds the spec's "~80 headers / ~1800 functions" budget — the walker captures full POSIX/sys surface in addition to libc.

Out of scope (per PR-01 plan)

• Loader, file:// or HTTP — PR-02
• Engine resolver integration in c_builder.go/cpp_builder.go — PR-02
• Windows/Darwin paths in walker — PR-03 (entry-point returns explicit PR-03-deferred error)
• GitHub Actions CI workflow — PR-03
• --diagnose-stdlib, resolution-report enhancements — PR-04

Verification

• ✅ go test ./... — all tests pass, no regressions on Phase 1
• ✅ golangci-lint run ./... — zero issues across entire repo
• ✅ gradle buildGo — clean build
• ✅ 91.5% coverage on new clikeextract package, 100% on new clike_stdlib_types.go
• ✅ Generator runs end-to-end: go run -tags cpf_generate_stdlib_registry tools/generate_clike_stdlib_registry.go --target=linux --language={c,cpp} --output-dir=... produces valid manifests on a real Ubuntu host.

Test plan

• Reviewer pulls the branch locally
• go test ./tools/internal/clikeextract/... ./graph/callgraph/core/ — passes
• go run -tags cpf_generate_stdlib_registry ./tools/generate_clike_stdlib_registry.go --target=linux --language=c --output-dir=/tmp/cpf-c — produces manifest.json + per-header JSONs
• Spot-check 5 entries against cppreference.com
• Confirm gradle buildGo and gradle lintGo succeed (Python lint failure on unrelated files is pre-existing)

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	29
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 88.61712% with 121 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.55%. Comparing base (90305d9) to head (682fa02).

Files with missing lines	Patch %	Lines
...ngine/tools/internal/clikeextract/cpp_extractor.go	78.87%	41 Missing and 23 partials ⚠️
...-engine/tools/internal/clikeextract/c_extractor.go	86.00%	17 Missing and 11 partials ⚠️
sast-engine/tools/internal/clikeextract/overlay.go	93.33%	8 Missing and 6 partials ⚠️
sast-engine/tools/internal/clikeextract/emitter.go	86.48%	5 Missing and 5 partials ⚠️
...st-engine/tools/internal/clikeextract/extractor.go	92.50%	2 Missing and 1 partial ⚠️
sast-engine/tools/internal/clikeextract/walker.go	98.23%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #679      +/-   ##
==========================================
+ Coverage   85.43%   85.55%   +0.11%     
==========================================
  Files         187      196       +9     
  Lines       27278    28341    +1063     
==========================================
+ Hits        23305    24247     +942     
- Misses       3082     3156      +74     
- Partials      891      938      +47     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.