refactor(search): run POSIX unscoped scan as argv stages, no shell (#2634) - #2749

Disclosure: this pull request was written with AI assistance on behalf of the account owner, who reviews and certifies every commit (DCO sign-off).

Summary

Implements the first phase of #2634 for the search pipeline: on POSIX, the unscoped code-search scan no longer builds a /bin/sh -c command string. Instead it runs as three supervised argv stages using the existing argv-based subprocess API:

1. find <root> -type f [-name <file_pattern>] -print0 writes the NUL-delimited candidate list
2. sort -z under LC_ALL=C orders the list in place
3. grep -Hn -E|-F -f <pattern_file> -- <files...> scans it in chunks of 256 files per invocation

grep exit status 1 (no matches in a chunk) is an ordinary empty result, and an empty file list short-circuits to an empty success without spawning grep — the same contract the retired xargs wrapper encoded.

What does not change

• Containment contract: the new mcp_run_argv_stage_cancellable_bounded runner reuses cbm_subprocess_spawn/cbm_subprocess_poll with the same cancellation latch, deadline handling, and cumulative output-limit latch as the existing shell runner, so cancel/deadline/oversized-output semantics are unchanged. find/sort failures fail closed, exactly like the old pipeline's status checks.
• Scope: only the POSIX, unscoped, no-override scan path is routed to the argv stages. The Windows build and any user-configured command override keep the existing shell runner, so the test override hooks behave exactly as before.
• No new system()/popen()/fork() calls — everything goes through the existing cbm_subprocess_* API, so the security allowlist is untouched.

The git helpers are left for a follow-up PR to keep this one under the project's size guidance.

Tested

• build/c/test-runner mcp (ASan+UBSan, x86_64 Linux): 383 PASS / 0 FAIL, including the existing search_code_recursive_fallback_propagates_discovery_failures family (discovery/sort failure propagation, no-match success, empty discovery), which now runs through the argv stages.
• Three new POSIX tests in tests/test_mcp.c, each on an unindexed project so the unscoped argv scan is exercised end to end:
  • a file whose name carries shell metacharacters (space, quote, backtick, $, ;) is discovered and searched literally;
  • a pattern with no matches returns success with "total_grep_matches":0;
  • file_pattern reaches find as a -name operand, so a non-matching extension is excluded and the same search without it matches.
• Broader suites: the full make -f Makefile.cbm test run does not complete in my 2 GB sandbox — the ASan/UBSan process is OOM-killed partway through (4,350 tests passed, 0 failures at the kill point, across the mcp, cross_repo, index_resilience, fqn, route_canon, path_alias, watcher, lz4, zstd, sqlite_writer, artifact, scope, type_rep and go_lsp suites). No failure was observed in any suite that ran; I'm relying on CI for the complete run.

Not tested

• Windows build (unchanged code path, still uses the shell runner).
• Custom command overrides (unchanged code path).
• scripts/lint.sh (no cppcheck/clang-format toolchain available in my environment).

Closes first phase of #2634.