W18: context cleanup + CLI fixes + loader audit + CI matrix (W18.1-W18.4)

- W18.1 (王测+林深): Remove g_max_tokens dead API, UTF-8 bounds protection, deduplicate token counting, 0xC0/0xC1 handling, add 13 test blocks (36 checks)
- W18.2 (赵码+朱晴): Fix /context no-session error message, /status 3-state connection display
- W18.3 (曹武+徐磊): plugin_loader security audit — 9 dimensions, rating C, 1 HIGH + 2 MEDIUM findings
- W18.4 (马奔+胡桐): CI dual-platform matrix (Ubuntu clang-18 + Windows clang-cl), ccache, build timing baseline

Build 0 error, ctest 5/5 pass, metadata check clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dstalk-core/include/dstalk/dstalk_services.h

@@ -39,7 +39,6 @@ typedef struct {
     int    (*trim)(const dstalk_message_t* in, int in_count,
                    dstalk_message_t** out, int* out_count,
                    size_t max_tokens);
-    void   (*set_max_tokens)(size_t max);
 } dstalk_context_service_t;
 
 // === HTTP 服务 (service name: "http") ===