Refactor + security hardening (closes #18)

[melogtm]

Summary

A comprehensive, 6-phase refactoring and security hardening of the trigger shell. Every confirmed bug from the #18 analysis is fixed, every design smell is addressed, and the codebase is substantially cleaner, safer, and easier to develop on.

---

🛡️ Bugs Fixed

#	Severity	Bug	Fix
1	HIGH	status uninitialized + waitpid unchecked → UB / busy-loop	Init status=0, EINTR retry, check return
2	HIGH	No SIGINT handling — Ctrl-C kills the shell	Parent ignores SIGINT/SIGQUIT, children reset to SIG_DFL
3	MED	Signed int sizes + O(n²) reallocs → overflow UB	All sizes → size_t with overflow-checked geometric doubling
4	MED	dup/dup2 unchecked → fd corruption	Check every call; abort command in parent, _exit in child
5	MED	Quoted operators leak into pipeline parser	glob_eligible passed to trigger_parse_pipeline
6	LOW/MED	glob() error falls through to uninitialized glob_t	Any nonzero return → keep literal
7	LOW	exit() flushes inherited stdio; exec failure should be 127	_exit(127) in children
8	LOW	WUNTRACED + no WIFSTOPPED → Ctrl-Z hangs shell	Drop WUNTRACED
9	LOW	Syntax error prints error but still runs the command	Parse returns NULL, command aborted

---

🧹 Design Improvements

Smell	Solution
Builtin dispatch copy-pasted at 4 sites	find_builtin() — single Builtin struct table, 4→0 dispatch loops
tokens[]/glob_eligible[] lockstep by hand	TokenList {argv, glob_eligible, count} struct
Pipeline: two near-identical passes, operator checks written 6×	classify_operator() enum, single-pass dynamic-realloc parse
Redirection open/dup2 duplicated	apply_redirection() shared across in-process and forked paths
free_pipeline duplicated verbatim in tests	Renamed trigger_free_pipeline, exported, single definition
#define true 1 / false 0	<stdbool.h>
9 scattered fprintf+exit on OOM	xmalloc / xrealloc / xstrdup centralized helpers
cwd[4096] magic buffer, bare 0644, unused TRIGGER_TOK_DELIM	getcwd(NULL,0), FILE_MODE, removed
No library target — 5 test binaries recompile sources by hand	trigger_core static library, all targets link against it
No -Wall -Wextra -Werror, no sanitizers	Enabled everywhere + sanitizer CI matrix

---

🏗️ Build & CI

• trigger_core static library — shell + all 5 test binaries link against it
• -Wall -Wextra -Werror on all compilation units
• TRIGGER_SANITIZE=ON option (Address + Undefined Behavior sanitizers)
• New sanitize CI job; detect_leaks=1
• All CTest names preserved: InputTests, BuiltinsTests, ExecuteTests, PipelineTests, GlobTests

---

🧪 New Tests

Test	What it verifies
cmd > → parse failure	Syntax error aborts command
cmd > | next → parse failure	Syntax error with pipe aborts
echo "|" | cat → 2 stages, | is literal arg	Bug #5: quoted operators not parsed
exit 3 → returns 3	exit [n] numeric argument support
Builtin function pointer equality	find_builtin("cd")->fn == trigger_cd
10k-char token + 200-token line	Realloc paths under sanitizers

---

✅ Preserved Invariants

• Glob eligibility: echo "*.c" / echo \*.c literal, echo *.c expands
• Unclosed quote → parse_line_with_quotes returns NULL
• Single-stage builtins run in-process; multi-stage builtins fork
• CTest names unchanged; LLVM/4-space/100col formatting
• trigger_split_line preserved as thin wrapper (tests depend on it)

---

📊 Code Metrics

• pipeline.c: ~354 → ~378 lines (refactored, features added)
• Net diff: +1765 / -1542 across 20 files
• 4 dispatch loops → 1 find_builtin() function
• 6 operator strcmp guards → 1 classify_operator() enum
• 9 OOM error paths → 3 x* helpers

---

Closes #18