fix: send-counter wrap guard (nonce reuse) + warning sweep, tidy-gated

[emir-hasanbegovic]

Summary

Two strands on one branch (single-branch fold by maintainer direction):

1. Send-counter wrap guard (serious, crypto) — the UDP send counter was a uint32 fetch_add with no exhaustion guard: at 2^32 packets in one unbroken session it wrapped and kept sealing ChaCha20-Poly1305 ciphertexts under reused (key, nonce) pairs — an on-wire keystream-reuse confidentiality leak (~50 days at a sustained 1 kHz). The counterNeedsRepush reducer existed with zero call sites. Now wired, mirroring dish-mac's G4 design: proactive re-key past 0xF0000000 + hard go-silent backstop at exhaustion.
2. Warning sweep — clears the 26 clang-tidy findings across src/, leaves the tree warning-clean under the CI's g++ -Werror build, and now gates the tidy step so findings cannot silently regress.

What changed

• 8942d1e fix(linux): clear the clang-tidy findings across src/ — resolves the 26 findings the CI clang-tidy step reports on main (performance-move-const-arg, performance-enum-size, performance-no-automatic-move, modernize-return-braced-init-list, cert-*, etc.).
• 8c253bf test(linux): mark vendored Catch2 headers SYSTEM — the vendored test framework stops contributing third-party diagnostics to the tidy/warning surface.
• bd144df chore(ci): cap the linux-ci job with timeout-minutes — a hung job self-cancels instead of squatting the 6-hour default.
• b12b127 fix(linux): drop useless std::move on QHash insert instead of operator[] — see the corrected note below.
• 2f79d9f style: trim warning-sweep comments to terse why-only.
• a6dbac6 fix(linux): never wrap the UDP send counter into ChaCha20 nonce reuse — sendEncrypted draws from a 64-bit counter and goes silent past 2^32−1 instead of wrapping; the 1 Hz alive tick fires a single-shot SessionHooks::rekey once the counter crosses 0xF0000000; the manager's runRekey re-PUTs and installs the fresh token/salt/key on the same socket (counters restart at 1, no state blip, stale responses can't re-arm a replaced client). Tests drive a real loopback socket across the exhaustion boundary (no wrapped packet on the wire; no counter value ever repeats under one key) and drive the tick wiring through a test seam (fires once per approach; re-arms only after the re-key lands).
• 8082360 test(linux): pin the intentionally strict TXT port parse — corrects this PR's earlier "no behavioral change" claim: from_chars rejects leading whitespace (udp= 9443) and an explicit + (udp=+9443) that atoi accepted. Kept strict deliberately — the live responder emits bare std::to_string digits (satellite mdns_responder.cpp), so nothing real is lost. The exact accept/reject set is pinned by tests (bare digits and numeric prefixes parse; whitespace/+/empty fall back to defaults).
• 10c9ed9 chore(ci): fail the clang-tidy gate on any reintroduced finding — --warnings-as-errors='*' at the CI + ci_local.sh invocations. .clang-tidy itself stays untouched: it is the fleet-canonical config shared with satellite/dish-android, so the gate lives in the invocation, scoped to the curated (now clean) check set. Verified by probe: a reintroduced modernize-use-nullptr finding fails the step.
• cc82d58 fix(linux): draw session material atomically for the live re-key — the proactive re-key makes setConnectionParams run against a live client for the first time; materialMtx_ now makes the (key, token, counter, replay-mark) swap atomic vs the SDL/heartbeat senders and the receive loop (dish-mac's nextSendMaterial design). Pinned by a two-thread × 40-generation hammer test: every wire packet must decrypt under the key its token selects, no (token, counter) pair repeats (failed 2/10 runs against an unlocked draw; 0/10 with the lock).

Note on the QHash inserts (corrected)

An earlier revision of this note claimed "QHash::insert has no rvalue overload, the move was always a no-op". That claim is wrong on Qt 6 — QHash::insert(const Key&, T&&) exists (qhash.h), so the moves were real. The code change stands for the right reasons anyway: operator[] took QHash through its detach→new Span[] path, which g++ -O2 flags with -Walloc-size-larger-than= inside qhash.h (a Qt/GCC false positive; clang never emits it), and dropping a move of a copyable std::function typedef in a UI-rate rebuild is harmless. insert stays; the tidy finding stays cleared; zero g++ build warnings.

Test evidence

Authoritative ubuntu-24.04 container gate on the branch head (cc82d58), mirroring linux-ci under g++:

• clang-format 22.1.4 (pinned): clean
• Debug build (tests on): 0 compiler warnings under -Werror
• 235/235 tests pass (up from 228: 7 new — exhaustion silence, wire monotonicity, re-key restart, re-key material hammer, tick wiring ×2, strict TXT parse)
• clang-tidy under the new --warnings-as-errors='*' gate: clean, and the probe (deliberately reintroduced finding) fails the step as intended
• Release build: green

Local macOS scripts/ci_local.sh (clang) also green end-to-end; new-test flake check: 10 consecutive clean runs of the hammer, 5 of the wiring tests.

🤖 Generated with Claude Code