fix(m3-security-nearmiss-26-audit): fix sec-nearmiss-26 buffer-write vulnerability, complete safe-label audit, update aggregate baseline

sec-nearmiss-26 had dead guard code (strnlen(src,255) bounded at 255 but
if(len>=256) could never fire) and wrote to unbounded dest — genuinely
vulnerable despite is_vulnerable=false label. Fixed with dest_size-1 bound
and explicit zero-size guard. Applied to all 3 artifacts (decisive split,
candidate pool, calib-sample). Re-scored single item: baseline changed
from 0.0 to 1.0 (model now correctly identifies as safe).

Re-audited all 10 'safe' near-miss items exhaustively: sec-nearmiss-26
was the only mislabel. Updated manifest aggregate baseline 0.584->0.624,
safe_near_misses baseline 0.75->0.875, fpr_safe_items 0.52->0.125.
Manifest item_counts still EXACTLY match decisive JSONL (70 items).
External HF data gitignored/unstaged; calib-sample untracked.