fix(security): prevent CWE-134 format string injection

- add "%s" to unsafe cons_show/log_*/win_println calls
- add check-cwe134.sh static analysis script
- integrate security check into CI pipeline

Closes #85

ci-build.sh

@@ -168,6 +168,10 @@ num_cores()
 # Run test failure detection verification first
 verify_test_failure_detection
 
+# Run CWE-134 format string vulnerability check
+echo "=== Running CWE-134 security check ==="
+./check-cwe134.sh || { echo "CWE-134 check failed!"; exit 1; }
+
 # Parse arguments
 COVERAGE_ONLY=no
 for arg in "$@"; do