fix(security): prevent CWE-134 format string injection

- add "%s" to unsafe cons_show/log_*/win_println calls
- add check-cwe134.sh static analysis script
- integrate security check into CI pipeline

Closes #85

.github/workflows/ci-code.yml

@@ -50,6 +50,9 @@ jobs:
         run: |
           grep -P 'auto_(char|gchar|gcharv|guchar|jid|sqlite|gfd|FILE)[\w *]*;$' -r src && exit -1 || true
 
+      - name: Check CWE-134 format string vulnerabilities
+        run: ./check-cwe134.sh
+
       - name: Install clang-format
         run: |
           sudo apt-get update

ci-build.sh

@@ -168,10 +168,6 @@ num_cores()
 # Run test failure detection verification first
 verify_test_failure_detection
 
-# Run CWE-134 format string vulnerability check
-echo "=== Running CWE-134 security check ==="
-./check-cwe134.sh || { echo "CWE-134 check failed!"; exit 1; }
-
 # Parse arguments
 COVERAGE_ONLY=no
 for arg in "$@"; do