Fix bugs found by clang-tidy triage; ratchet warning budget to zero

[madeye]

Summary

Full triage of the 29 baseline clang-tidy findings from #3046: every finding was either fixed or verified as a false positive and annotated. The CI ratchet (MAX_WARNINGS) drops from 29 to 0, so any new clang-tidy finding now fails CI.

Real bugs fixed

• manager.c — uninitialized pid passed to kill(): kill_server/stop_server checked fscanf(...) != EOF, which passes when the pid file contains garbage (fscanf returns 0), leaving pid uninitialized and signaling an arbitrary process — potentially catastrophic when ss-manager runs as root. Now parsed with fgets + the hardened ss_parse_int, requiring pid > 0.
• utils.c — crash when HOME is unset: get_default_conf() called strlen(getenv("HOME")) without a NULL check (daemons started by init systems commonly have no HOME), and also left a dangling static pointer after free(), a latent use-after-free on repeated calls. Rewritten with a static buffer and a graceful fallback to the system config. Verified: env -u HOME ss-local now errors cleanly instead of segfaulting.
• local.c — uninitialized fd handed to library callback: in UDP_ONLY mode start_ss_local_server() never set listen_ctx.fd but still passed it to the callback. Initialized to -1.

Improvements

• Upstream-server selection in ss-local/ss-redir/ss-tunnel now uses libsodium randombytes_uniform() instead of rand() % n with srand(time(NULL)) — unbiased and unpredictable, no seeding needed.
• FATAL() is now noreturn, teaching the compiler and analyzers about control flow (eliminates a family of analyzer false positives).
• Removed two dead stores (manager.c, udprelay.c).

False positives (NOLINT with rationale)

uthash macro internals (use-after-free / div-by-zero models), symmetric server<->remote back-pointer cleanup, getpeername/cork_ip_init postconditions the analyzer can't see, binary protocol buffers flagged by C-string checks, and one intentional dead store in vendored json.c.

Verification

• macOS: Release + ASan/UBSan builds, 12/12 ctest, 3/3 stress-test ciphers, ss-manager target compiles under -Werror.
• Linux (ubuntu:24.04 at CI parity): full build incl. ss-manager, 12/12 ctest, 3/3 stress, clang-tidy-18: zero warnings.

🤖 Generated with Claude Code