fix(graph): fvc_search self-protects its FVC_MAX_VERTICES stack buffers (RG-2 #2)

[stblake]

Summary

Closes RG-2 adversarial finding #2 (from PR #73): fvc_search is exported in
src/graph/graph.h, and its inner fvc_bb uses stack arrays
char seen[FVC_MAX_VERTICES + 2] / char forbid[FVC_MAX_VERTICES + 2], indexed
up to used + 1 as the search deepens. The 128-vertex cap that keeps those
indices in bounds was enforced only in the head builtin_find_vertex_coloring,
never in fvc_search — and because the symbol is exported while
FVC_MAX_VERTICES is not, a cross-TU caller passing n > 128 could not discover
the precondition and would overflow the buffers.

Fix (one line + comment)

fvc_search now refuses (return 0) when n > FVC_MAX_VERTICES, so the
invariant lives with the buffers it protects rather than in an untrusted caller.
return 0 is the existing "cannot prove minimality, refuse" contract, so the
head leaves the expression unevaluated exactly as it already does for n > 128.

No behaviour change on the head path — builtin_find_vertex_coloring already
filters n > 128 before calling in, so every graph that reaches fvc_search
through the head has n ≤ 128 and is unaffected.

Test

A regression assertion in test_vertex_coloring_internals: a direct
fvc_search on CompleteGraph[129] must return 0 with zero steps. Without the
guard it returns 129 via the lb >= ub short-circuit, so the assertion fails
when the guard is absent — a genuine regression check, not a tautology.

Verification

• Default build clean (-Werror gate set).
• graph_tests green — 17 tests incl. test_vertex_coloring / test_vertex_coloring_internals (true exit 0, captured unpiped).
• make check-c99, make check-packed-aware pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_018GNB6E1ftx4TkAk47VfkNJ