fix: codebase quality audit round 2

[b-macker]

Summary

• Phase A (security): Fix 4 catch blocks that silently bypass governance checks — network check regex, agent restriction regex, baseline parse errors, benchmark popen() injection. All now fail-closed.
• Phase B (dead code): Delete 6 dead source files (1,240 lines), remove 2 dead compiled files from build (921 lines), deduplicate string.repeat(), fix 3 always-fire linter false positives, delete ~15 superseded linter stubs, wire detectIncorrectMainFunction into dispatch.
• Phase C (silent failures): Python error sites throw instead of fmt::print + makeNull, module loading errors throw instead of print + return, fix validate.email() (reject ..), fix validate.ipv6() (enforce single :: and proper groups), CSV parser handles RFC 4180 "" escaping, uuid.v5() gives clear hex parse error.
• Phase D (hollow logic): Document bolo.scan() AUDIT-only as by-design, fix assigned_never_read nested function scope bug in scanner, add rationale comments to language scorer adjustment values.

Net: 22 files changed, 212 insertions, 1,735 deletions.

Test plan

• bash run-all-tests.sh — 396 tests, 0 new unexpected failures (1 pre-existing cold-start)
• bash tests/security/test_error_msg_leaks.sh — 738 checks, 0 failures
• Build passes: cmake .. && make naab-lang -j4 — 0 errors
• Verify Phase A security fixes: invalid regex in govern.json agent restrictions should block (fail-closed)
• Verify Phase C: validate.email("user..name@example.com") returns false
• Verify Phase C: CSV with "" embedded quotes parses correctly

🤖 Generated with Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.