fix: Gemini 40-level audit pass 2 — 8 hardening fixes

[b-macker]

Summary

• L3: Replace deterministic std::rand() jitter with std::mt19937 seeded from std::random_device in agent retry loop
• L5: Fix --sandbox-level help text — claimed "standard" default but code initializes to "unrestricted"
• L7: JSON large integer silent wrapping → fall back to double for values outside INT32 range (JavaScript behavior)
• L9: Sanitize file paths in logAuditEvent() — consistency with PR fix: telemetry path leak + REPL hardcoded block count #34 telemetry path sanitization
• L31: Port Windows generation-counter pattern to POSIX timer cancel (eliminates shared-static fragility)
• L36a: RAII fd guard in readFileBounded() — exception-safe cleanup
• L36b: Add ROLLBACK on error path in buildIndex() — SQLite transaction leak
• L37: Range-check NaabVal::toInt() double-to-int cast — was UB for out-of-range values, now clamps to INT_MIN/INT_MAX

Audit Stats

• Pass 2 FP rate: 11% (1/9) — down from 77% in pass 1 (improved prompt worked)
• 8 files changed, 34 insertions, 10 deletions

Test plan

• Full test suite: 396/396, 0 unexpected failures
• Security leak check: 738/738 passed
• --help shows (default: unrestricted) for sandbox-level
• int(99999999999.0) → 2147483647 (INT_MAX), not crash/garbage
• json.parse('{"n":9999999999}') → float, not garbage int

🤖 Generated with Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}