[gouyt13]

Follow-up to #195: the audit's Suggestion-level items that need no contract decision. Five independent commits.

Library

• fix(ivf) — IVF::load accepted any bytes after the ID section (HNSW and SymphonyQG reject a payload that is not exactly the expected length); it now throws IVF index file has unexpected trailing data and leaves the target index unchanged. IVF::write_file checked nothing before setting the stream exception mask, so an unwritable destination surfaced as basic_ios::clear: iostream error; it now throws IVF cannot open index file for writing like the other writers. FlatInitializer::save/load check the stream as FlatRaBitQInitializer already did. Regression tests for all three; the frozen v0.5.2 and pre-per-cluster fixtures still load.
• fix(symqg) — the C++ QGBuilder accepted ef_construction == 0 and silently built a graph from reverse edges and random fill; it now throws std::invalid_argument (the Python wrapper already did).
• fix(clustering) — iteration_stats.reserve(niter) allocated for the documented maximum iteration count (32 GB for niter = 1e9) after centroids and assignments had been resized; the reserve is gone.

Scripts

• build — format-changed.sh read the file-list helper through process substitution, so a failing helper formatted nothing and exited 0 (the same defect check-format.sh was already fixed for); it now captures the list and checks the helper's status. The three formatter scripts no longer use xargs --no-run-if-empty or realpath --relative-to, which BSD userlands lack although macOS is a documented host; xargs -r is accepted by GNU and BSD, and absolute paths are normalized with cd && pwd -P.

Tests and CI

• test — GoogleTest exits 0 when a --gtest_filter matches nothing, so a renamed suite could silently remove the OpenMPBinding CTest entry and parts of the Intel SDE coverage. The CTest entry now requires its one expected test via PASS_REGULAR_EXPRESSION; the SDE step verifies that every filter pattern lists at least one test before running. The two consumer ctest calls in tests/core_consumer/run.cmake gain --no-tests=error as AGENTS.md requires. Test temp files (TempFile and the historical-persistence outputs) carry the process ID so concurrent suites sharing a temp directory cannot delete each other's files. fastscan_no_simd_test's HACC case asserts that the generic backend ran, instead of relying on a sum the AVX2 kernel produces identically.

Verification

• check-format.sh, ShellCheck on the four scripts, git diff --check; .github/scripts unittest suite 60/60; actionlint on test.yaml (only the pre-existing runner-label notice).
• GCC 14 portable build: ctest --no-tests=error 437/437 (three new tests); Clang 23 ASan/UBSan build: 437/437, no diagnostics.
• tests/core_consumer/run.cmake (OpenMP ON, all integrations) passes with the stricter ctest flags.
• Reinstalled package: pytest tests/python 837 passed, 2 skipped.
• Focused clang-tidy on ivf.cpp, ivf_initializer.cpp, qg_builder.cpp and the binding TUs that include the changed headers.
• Script harness: format-changed.sh with a failing helper exits 1, with an empty list exits 0; clang-format-files.sh resolves /repo/src/core/../core/api.cpp and skips /etc/hostname.

Not verified here: macOS execution of the scripts (static only), the SDE step on a hosted runner (its CI run on this PR is the check).