Wave 9: fix audit findings, harden ABI, deduplicate config (W12.1-W12.6)

- W12.1 context_plugin (engineer-zhou): wrap C ABI surface in try/catch,
  add OOM-safe strdup_message_fields helper, make g_max_tokens drive
  message-count trim (option A).
- W12.2 config refactor (architect-lin): introduce
  plugins/config/include/toml_parse.h to eliminate 74-line parser
  duplication; config_plugin delegates to host->config_get/set,
  collapsing the dual-store data island; ConfigStore::get() now copies
  via thread_local std::string to remove c_str() dangling under
  concurrent set(). Zero ABI changes.
- W12.3 CLI command parsing (engineer-zhao): guard /clear and /context
  on missing session service; refactor /file dispatch so bare
  /file write hits usage instead of unknown-command.
- W12.4 build path unification (devops-hu): set per-target
  RUNTIME_OUTPUT_DIRECTORY on dstalk-cli; remove stale
  build/dstalk-cli/dstalk-cli.exe so build/bin/ is the sole binary.
- W12.5 STATUS.md auto-refresh (engineer-li): run W11.6 script to
  regenerate STATUS from live profile/group data.
- W12.6 plugin-abi.md (writer-deng): add §8 exception safety across
  ABI boundary and §9 string return lifetime; reference real
  audit-found violations as anti-examples.

Verified: cmake build 0 error 0 warning, ctest 4/4 pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

dstalk-core/src/config_store.cpp

@@ -1,4 +1,5 @@
 #include "config_store.hpp"
+#include "../../plugins/config/include/toml_parse.h"
 
 #include <cstdio>
 #include <fstream>
@@ -18,47 +19,11 @@ int ConfigStore::load_file(const char* path)
     ss << file.rdbuf();
     std::string data = ss.str();
 
-    // 简易 TOML 解析：只处理 [section] 和 key = "value"
-    std::string current_section;
-    size_t pos = 0;
-    while (pos < data.size()) {
-        while (pos < data.size() && (data[pos] == ' ' || data[pos] == '\t'))
-            pos++;
-        if (pos >= data.size()) break;
-
-        size_t nl = data.find('\n', pos);
-        std::string line = (nl != std::string::npos)
-            ? data.substr(pos, nl - pos) : data.substr(pos);
-        pos = (nl != std::string::npos) ? nl + 1 : data.size();
-
-        while (!line.empty() && (line.back() == '\r' || line.back() == ' '))
-            line.pop_back();
-
-        if (line.empty() || line[0] == '#') continue;
-
-        if (line[0] == '[' && line.back() == ']') {
-            current_section = line.substr(1, line.size() - 2);
-            continue;
-        }
-
-        size_t eq = line.find('=');
-        if (eq == std::string::npos) continue;
-
-        std::string key = line.substr(0, eq);
-        while (!key.empty() && key.back() == ' ') key.pop_back();
-        if (key.empty()) continue;
-
-        std::string val = line.substr(eq + 1);
-        while (!val.empty() && (val.front() == ' ' || val.front() == '\t'))
-            val.erase(0, 1);
-        if (val.size() >= 2 && val.front() == '"' && val.back() == '"')
-            val = val.substr(1, val.size() - 2);
-
+    // W12.2: Use shared TOML parser (de-duplicated from config_plugin.cpp)
+    toml::parse(data, [this](const std::string& key, const std::string& value) {
         std::lock_guard<std::mutex> lock(mutex_);
-        std::string full_key = current_section.empty()
-            ? key : current_section + "." + key;
-        data_[full_key] = val;
-    }
+        data_[key] = value;
+    });
 
     return 0;
 }
@@ -69,7 +34,22 @@ const char* ConfigStore::get(const char* key) const
     std::lock_guard<std::mutex> lock(mutex_);
     auto it = data_.find(key);
     if (it == data_.end()) return nullptr;
-    return it->second.c_str();
+
+    // W12.2: Copy to thread-local buffer before releasing lock.
+    // Prevents c_str() dangling when concurrent set() on the same key
+    // triggers std::string reallocation (W11.2 audit Finding 3).
+    thread_local std::string tls_cached;
+    tls_cached = it->second;
+    return tls_cached.c_str();
+}
+
+std::string ConfigStore::get_copy(const char* key) const
+{
+    if (!key) return {};
+    std::lock_guard<std::mutex> lock(mutex_);
+    auto it = data_.find(key);
+    if (it == data_.end()) return {};
+    return it->second;  // copy-constructed under lock, always safe
 }
 
 int ConfigStore::set(const char* key, const char* value)