W18: context cleanup + CLI fixes + loader audit + CI matrix (W18.1-W18.4)

- W18.1 (王测+林深): Remove g_max_tokens dead API, UTF-8 bounds protection, deduplicate token counting, 0xC0/0xC1 handling, add 13 test blocks (36 checks)
- W18.2 (赵码+朱晴): Fix /context no-session error message, /status 3-state connection display
- W18.3 (曹武+徐磊): plugin_loader security audit — 9 dimensions, rating C, 1 HIGH + 2 MEDIUM findings
- W18.4 (马奔+胡桐): CI dual-platform matrix (Ubuntu clang-18 + Windows clang-cl), ccache, build timing baseline

Build 0 error, ctest 5/5 pass, metadata check clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

agents/qa-wang/profile.md

@@ -48,6 +48,9 @@ performance_log:
   - date: 2026-05-27
     event: "W17.3: 验证 W14 已修复的 4 条发现并关单 + F-11.7-2。F-13.1-1 (anthropic 6 C ABI try/catch) PASS，F-13.1-4 (sse_line_callback 异常保护) PASS，F-13.2-1 (deepseek C++ 异常被外层 catch) PASS，F-13.2-2 (非对称异常保护已消解) PASS。F-11.7-2 /clear 命令代码已有 g_session null 检查 (L168-174)，无需修改代码直接关单。5 条全部 CLOSED。编译 0 error + ctest 4/4 pass。"
     rating: A
+  - date: 2026-05-27
+    event: "W18.1 (协作 林深): 关闭 F-11.1-3/4/5/6 共4条 context_plugin 遗留发现。(3) 删除 g_max_tokens 死变量 + context_set_max_tokens API + dstalk_services.h vtable 字段；(4) count_tokens_utf8 共享函数新增多字节序列越界检查（i+N >= len + 后继字节 0x80 校验）；(5) 提取 count_tokens_utf8(const char*, size_t, size_t) 取代 count_tokens_one_message / count_tokens_trim 双份重复实现；(6) 新增 c==0xC0||0xC1 分支检测过短编码。新增 context_plugin_test.cpp (13 测试块, 36 CHECK)，覆盖 ASCII/CJK/mixed/truncated UTF-8/0xC0-0xC1/4-byte/multi-msg/trim null+limit+system。更新 findings-registry Closed + Change Log。编译 0 error + ctest 5/5 pass。"
+    rating: A
 current_groups:
   - grp-quality-core (组长)
 ---