W18: context cleanup + CLI fixes + loader audit + CI matrix (W18.1-W18.4)

- W18.1 (王测+林深): Remove g_max_tokens dead API, UTF-8 bounds protection, deduplicate token counting, 0xC0/0xC1 handling, add 13 test blocks (36 checks)
- W18.2 (赵码+朱晴): Fix /context no-session error message, /status 3-state connection display
- W18.3 (曹武+徐磊): plugin_loader security audit — 9 dimensions, rating C, 1 HIGH + 2 MEDIUM findings
- W18.4 (马奔+胡桐): CI dual-platform matrix (Ubuntu clang-18 + Windows clang-cl), ccache, build timing baseline

Build 0 error, ctest 5/5 pass, metadata check clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

agents/engineer-zhao/profile.md

@@ -48,3 +48,6 @@ current_groups:
   - date: 2026-05-27
     event: "W17.2: 修复 deepseek_plugin 2条 MEDIUM — F-13.2-3 SSE [DONE] sentinel trim后比较替代精确匹配（L208-218），F-13.2-4 g_host/g_http/g_config 改为 std::atomic load(acquire)/store(release) 保护（全文件54处访存点），编译0 error + ctest 4/4 pass"
     rating: A-
+  - date: 2026-05-27
+    event: "W18.2: 协作朱晴完成 CLI 命令分发修复 — F-11.7-3 /context else 分支消息改为 No active session (main.cpp:188)，确认 F-11.7-4 已被重构的 /file 分发器修正 (main.cpp:274)，/status 增加连接状态三态展示 (main.cpp:205-211)，编译 0 error + ctest 4/4 pass"
+    rating: A