fix(adhoc-sweep-fixes): CU-86akdypw4 19 review findings across 19 files

[flamingo]

Closes 19 review findings across 19 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🟢 92 high	smbios.js amtInfo() dereferences data[131] without existence check, will throw on systems lacking that SMBIOS table	modules/smbios.js:301
2	🟢 90 high	wget.js swallows request rejection reason as a bare string rather than an Error object	modules/wget.js:82
3	🟡 82 medium	OnConnectSink frees data on TLS connection failure but does not clear the socket's stored user pointer, risking a use-after-free/double-free	microstack/ILibAsyncServerSocket.c:384
4	🟢 90 high	_resetNodeId() calls WriteKey unconditionally on all platforms, not just win32	modules/_agentNodeId.js:139
5	🟢 92 high	OPENSSL_load_u16_be uses OSSL_LE16TOH guard but calls OSSL_BE16TOH — inconsistent macro/branch pairing repeated across load_be helpers	openssl/include/openssl/byteorder.h:218
6	🔴 55 low — review closely	generate_module_string.js regex-based C source patching is fragile and can corrupt ILibDuktape_Polyfills.c on partial matches	scripts/generate_module_string.js:72
7	🟡 70 medium	Overly broad write permissions granted to a PR-triggered CI workflow	.github/workflows/test.yml:2
8	🟡 70 medium	Windows-only input.c file includes <Windows.h> without a WIN32 guard, guarded only by _LINKVM	meshcore/KVM/Windows/input.c:17
9	🔴 40 low — review closely	wincrypto_open leaks subjectEncoded, pbPolicyInfo2, and pbBasicConstraints buffers on multiple early 'goto error'/'goto end' paths	meshcore/wincrypto-dualmode.cpp:226
10	🟡 75 medium	ILibDuktape_DGram_send silently drops UDP resolution result without checking ILibResolveEx return code	microscript/ILibDuktape_Dgram.c:325
11	🟡 75 medium	Unvalidated length field from network buffer used directly to slice without bounds check	modules/amt-lme.js:152
12	🟡 70 medium	waylandStatus/disableWayland/enableWayland duplicate near-identical gdm/gdm3 shell-scripting blocks	modules/kvm-helper.js:124
13	🟡 85 medium	get_encoderClsid mismatched size unit passed to wcsncmp causing likely bug	meshcore/KVM/Windows/tile.cpp:79
14	🔴 40 low — review closely	ILibDuktape_Compressor_End ignores deflate() error and still calls WriteEnd, potentially propagating truncated/corrupt compressed data	microscript/ILibDuktape_CompressedStream.c:132
15	🟡 75 medium	wincrypto-dualmode.cpp uses a file-scope static addTemp shared across SHA calls creating cross-context corruption risk (in sha224-256.c)	microstack/nossl/sha224-256.c:93
16	🔴 55 low — review closely	win-securitycenter unregister failure silently ignored with empty block	modules/win-securitycenter.js:101
17	🟡 85 medium	Leftover debug console.log statements in win-crypto.js certificate creation path	modules/win-crypto.js:287
18	🟢 95 high	pwdtest.js sample uses undeclared loop variable 'i' as an implicit global	samples/snippets/pwdtest.js:37
19	🔴 55 low — review closely	macOS universal-build test workflow hardcodes a feature-branch name as its default ref	.github/workflows/test-makefile-build-macos-universal.yml:4

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 3f8dcc8a-490a-435f-9b5e-47e003ea63b7

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akdypw4 Ad hoc sweep fixes across services (14 PRs)