feat(cpp-phase2): PR-02 loader, resolver integration, linux validation

[shivasurya]

Summary

PR-02 of the C/C++ Phase 2 stdlib stack. Turns the per-header JSON manifests from PR-01 into a working stdlib resolution path inside Phase 1's call-graph builders. After this PR, pathfinder ci and pathfinder scan resolve printf, std::vector::push_back, std::move, etc. against the registries on disk.

Stacked on #679 — must merge AFTER PR-01. Base branch is shiva/cpp-phase2-pr01-generator; once #679 lands, this PR will auto-rebase onto main.

What's in here

• core + registry: CStdlibLoader / CppStdlibLoader interfaces, file:// + HTTP-stubbed loaders mirroring go_stdlib_remote.go, platform detector (macros + path hints), 24h-TTL disk cache (consumed by PR-03's HTTP path), SystemIncludes index.
• builder: resolveCCallTarget and resolveCppCallTarget gain a 3-tuple return; new lookupCStdlib, lookupCppStdlibMethod, lookupCppStdlibFreeFunction consult the loaders after Phase 1 resolution. Template parameters (T / U / V / K) are substituted into stdlib return types when applicable. Project definitions still shadow stdlib symbols.
• cmd: --target and --stdlib-base-url flags on scan and resolution-report. Failures degrade to nil-loader-but-keep-scanning so a missing manifest never breaks a run.
• testdata: testdata/c/stdlib/main.c and testdata/cpp/stl/main.cpp smoke fixtures.

Out of scope (per PR-02 spec)

• HTTP loader implementation — PR-03 (calls return explicit "PR-03" errors today)
• --diagnose-stdlib mode + resolution-report stdlib line — PR-04
• Live large-codebase validation gate — runs as a manual step before PR-03

Verification

• gradle buildGo — clean
• go test ./... — all packages pass
• golangci-lint run ./... — 0 issues
• Coverage: 91.6% registry, 85.7% builder, 94.7% core; 100% on new cmd helpers (initClikeStdlib, loader builders, logger adapter)

Test plan

• CI green
• Manual smoke: pathfinder scan --project sast-engine/testdata/c/stdlib --stdlib-base-url=file://<pr01-output> --target=linux resolves all 5 calls in main.c
• Manual smoke: same against testdata/cpp/stl/main.cpp

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	23
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 89.56954% with 63 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.61%. Comparing base (682fa02) to head (6204dda).

Files with missing lines	Patch %	Lines
...gine/graph/callgraph/registry/cpp_stdlib_remote.go	87.15%	7 Missing and 7 partials ⚠️
sast-engine/graph/callgraph/builder/cpp_builder.go	91.96%	6 Missing and 3 partials ⚠️
...ngine/graph/callgraph/registry/clike_disk_cache.go	83.92%	6 Missing and 3 partials ⚠️
sast-engine/cmd/scan.go	88.57%	6 Missing and 2 partials ⚠️
sast-engine/graph/callgraph/registry/c_module.go	61.90%	6 Missing and 2 partials ⚠️
...raph/callgraph/registry/clike_platform_detector.go	92.07%	4 Missing and 4 partials ⚠️
...engine/graph/callgraph/registry/c_stdlib_remote.go	93.40%	3 Missing and 3 partials ⚠️
sast-engine/graph/callgraph/builder/c_builder.go	96.96%	1 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                         @@
##           shiva/cpp-phase2-pr01-generator     #680      +/-   ##
===================================================================
+ Coverage                            85.55%   85.61%   +0.06%     
===================================================================
  Files                                  196      200       +4     
  Lines                                28341    28912     +571     
===================================================================
+ Hits                                 24247    24754     +507     
- Misses                                3156     3195      +39     
- Partials                               938      963      +25     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.