c-security-review

# C security review ## Contract | Field | Bound contract | |---|---| | Trigger | The user requests a complete userspace C or C++ security review with an explicit threat model, severity filter, and model. | | Authority | Reversible local: write only the `.c-review-results/<stamp>/` run directory under the current working directory. Roll back by deleting that directory; no reviewed source tree, VCS, credential, or remote is mutated. | | Side effect | A `.c-review-results/<iso-timestamp>/` directory holding REPORT.md, REPORT.sarif, and findings.json. | | Done | Every source file in scope is reviewed or named as uncovered, REPORT.md and REPORT.sarif agree, findings are filtered by severity, and the report discloses that no false-positive review ran. | ## Inputs Required, resolved before review. Infer from free text on the invocation ("remote" to REMOTE, "local" to LOCAL_UNPRIVILEGED, "all" or "high only", an explicit model name, "X only" to scope_subpath), then ask once for whatever stays unresolved. Never silently default a required parameter. - `threat_model`: REMOTE / LOCAL_UNPRIVILEGED / BOTH. Scopes which bug classes are in scope and the severity table the reviewer scores against. - `worker_model`: the model for every review pass; an explicit name, or `inherit` for the session model. - `severity_filter`: all / medium / high. What reaches REPORT.md and REPORT.sarif. Optional: - `scope_subpath` (default `.`): repo-relative directory; a finding must live inside it and it...