W16: close CRITICAL/HIGH findings, integrate metadata gate, complete audit summaries (W16.1-W16.6)

- W16.1 (曹武): F-11.7-1 CLOSED — confirmed W12.4 fix, corrupt binary eliminated
- W16.2 (孙宇): F-11.1-1 FIXED — context_plugin.cpp try/catch on set_max_tokens + on_shutdown
- W16.3 (陈风): F-11.1-2 CLOSED — confirmed W12.1 fix, strdup OOM protection already in place
- W16.4 (胡桐): Integrate check_agents_metadata into refresh_status.py as pre-gate (error→exit 1)
- W16.5 (周岩): Add Findings Summary to W13.3 network audit, register 3 findings
- W16.6 (赵码): Add Findings Summary to W13.1+W13.2 AI audits, register 8 findings (4 already W14-fixed)

Build 0 error, ctest 4/4 pass, metadata check 0 error 0 warning.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/context/src/context_plugin.cpp

@@ -315,8 +315,15 @@ static int context_trim(const dstalk_message_t* in, int in_count,
     }
 }
 
+// W16.2: 包裹 try/catch 防止异常穿越 C ABI 边界 (§8.3 void 仅 log)
 static void context_set_max_tokens(size_t max) {
-    g_max_tokens = max;
+    try {
+        g_max_tokens = max;
+    } catch (const std::exception& e) {
+        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] context_set_max_tokens: %s", e.what());
+    } catch (...) {
+        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] context_set_max_tokens: unknown exception");
+    }
 }
 
 static dstalk_context_service_t g_context_service = {
@@ -352,9 +359,20 @@ static int on_init(const dstalk_host_api_t* host) {
     }
 }
 
+// W16.2: 包裹 try/catch 防止异常穿越 C ABI 边界 — void 函数仅 log
 static void on_shutdown() {
-    g_session = nullptr;
-    g_host = nullptr;
+    try {
+        g_session = nullptr;
+        g_host = nullptr;
+    } catch (const std::exception& e) {
+        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] on_shutdown: %s", e.what());
+        g_session = nullptr;
+        g_host = nullptr;
+    } catch (...) {
+        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] on_shutdown: unknown exception");
+        g_session = nullptr;
+        g_host = nullptr;
+    }
 }
 
 static dstalk_plugin_info_t g_info = {