P2: Close CI gaps — Linux build, macOS plugin/engine build, hard-fail static analysis, Companion tests

[iamfatness]

Problem

Several CI gaps let platform-specific and code-quality regressions reach manual testing:

• Linux is never built or tested in CI despite README claiming Linux support.
• macOS CI builds with -DCOREVIDEO_BUILD_PLUGIN=OFF and -DCOREVIDEO_BUILD_ENGINE=OFF (tests only) and has no package validation (Windows-only Test-CoreVideoPackage.ps1).
• Static analysis is soft-fail (continue-on-error: true for cppcheck + flawfinder); CodeQL runs build-mode: none; tests/ is excluded from the cppcheck scan path.
• No code-coverage measurement anywhere.
• The Companion TypeScript module (companion/.../src/*.ts, ~1,250 LOC) has lint but no test runner and no tests.

Outcomes

• A Linux CI build job compiles plugin + engine + sidecar.
• macOS CI actually builds the plugin and engine (not just tests).
• cppcheck/flawfinder hard-fail on new findings; tests/ is included in the cppcheck scan path.
• A Companion test runner (e.g. vitest) covers the WebSocket clients and message parsing.

Acceptance criteria

• CI fails when the Linux or macOS plugin/engine build breaks.
• A newly introduced static-analysis finding blocks the build.
• npm test (or equivalent) runs in the Companion module's CI lane.

Filed from a CI/release evaluation; complements #103.

https://claude.ai/code/session_01TBgLWK55PHN83g4225H3kf