Extend sfm audit with nullable dereference analysis

[TeamDman]

Context

Issue #535 exposed a client crash when the manager screen rendered tick-time history before any samples had been populated. PR #589 fixes the immediate crash by treating null tick-time entries as zero-duration samples.

The underlying pattern was a value that could be null being dereferenced without a guard:

Duration candidate = menu.tickTimes[i];
candidate.compareTo(peakTickTime);

The existing sfm audit command audits source size, direct mod-event annotations, and version-surface drift, but it does not identify this class of Java nullability problem.

Proposal

Extend sfm audit with Java nullability analysis that can infer when a value may be null and report dangerous dereferences. The analysis should account for at least:

• @Nullable annotations and nullable return values/parameters/fields.
• Null initializers and nullable array elements, including arrays created without populating every element.
• Nullable values propagated through local assignments and simple method calls.
• Dereferences such as method calls, field access, unboxing, and array access.
• Common guards such as value != null, Objects.requireNonNull, instanceof, and early returns, to avoid warnings when the value has been proven non-null.

Warnings should identify the dereference location and, where practical, the source of the inferred nullability. The analysis should have focused tests for both dangerous and guarded examples, including the pattern from #535.

Acceptance criteria

• sfm audit reports the unguarded Duration dereference in a representative fixture.
• sfm audit does not report the equivalent code after the null guard added by Fix manager screen tick history crash #589.
• The output identifies the file, line, dereference, and nullability reason.
• The analysis is documented and has a deliberate false-positive/suppression strategy.