Fix memory-safety and correctness bugs surfaced by Coverity audit - #22234

Coverity CID 459644 (RESOURCE_LEAK): nd_journal_directory_scan_recursively()
opened a directory before checking whether it had already been scanned.
Close the duplicate-path DIR handle on the early-return path so repeated
directories do not leak file descriptors.

nd_journal_directory_scan_recursively() used depth++ (post-increment)
when recursing into subdirectories, which passes the caller's current
depth to the recursive call and then increments the caller's local
counter across sibling iterations. Effect: the 2nd, 3rd, ... sibling
subdirectories of the same parent get inflated depths and prematurely
hit VAR_LOG_JOURNAL_MAX_DEPTH, silently truncating legitimate scans.

Use depth + 1 instead so every recursion starts exactly one level
deeper than the current frame.

Coverity CID 413854 (UNINIT): skip the current domain when `libxl_domain_info()` fails before hashing or storing its UUID. This avoids using an uninitialized `uuid` buffer on the error path in `xenstat_collect()`.

Coverity CID 501623 (CHECKED_RETURN): `send_curl_request()` read `public.pem`
into a fixed buffer without reserving space for a trailing NUL, then passed it
through the JSON string path as a C string. Read at most `sizeof(public_key) - 1`
bytes, keep the byte count, and terminate the buffer explicitly before use.

Coverity CID 501624 (FORWARD_NULL): guard the 422 errorMsgKey comparisons in send_curl_request() when the claim server omits or mis-types errorMsgKey.
Fall back to the existing generic 422 failure message instead of dereferencing a NULL string.

The claim flow buffered the full HTTP response body with no upper bound,
which allowed a hostile endpoint to force unbounded growth during the curl
transfer. Cap the response at 10 MiB in the write callback and configure
libcurl to reject oversized responses early when the size is advertised.

Coverity CID 501625 (CHECKED_RETURN): stop ignoring curl_easy_setopt() errors when preparing claim requests. Abort the request setup with a clear failure reason instead of continuing with partially applied curl options such as a rejected proxy configuration.

Coverity CID 410102 (TAINTED_SCALAR): copy_and_convert_key() cast
PCRE2 name-table bytes to unsigned instead of unsigned char, which can
turn non-ASCII UTF bytes in named groups into huge indexes on signed-char
builds. Cast through unsigned char before indexing
journal_key_characters_map.

Coverity CID 410217 (TAINTED_SCALAR): logfmt escape parsing advanced past the terminating NUL when a key or value ended with a lone backslash. Treat trailing backslashes as literal characters so the parser stays in-bounds without changing valid escape handling.

Coverity CID 440042 (INTEGER_OVERFLOW): health_alarm_log_populate() read
non_clear_duration from SQLite directly into the uint32_t ACLK field.
Clamp negative values to 0 and oversized values to UINT32_MAX before
serializing alert log entries.

Coverity CID 439996 (INTEGER_OVERFLOW): only process `${label:...}` placeholders when the token is complete and ends with `}`. This prevents the label-name truncation math from indexing before the local buffer on unterminated placeholders.

Coverity CID 457729 (INTEGER_OVERFLOW): print_fraction() underflowed its loop bound when callers requested 7-9 fractional digits.
Scale microseconds down for shorter output and pad zeros for 7-9 digits so the formatter preserves the existing 1..9-digit contract without hanging.

Coverity CID 414657 (REVERSE_INULL): a rejected item-acquire path in
`dict_item_add_or_reset_value_and_acquire()` left `item` non-NULL, so the
`do/while` loop exited instead of retrying after stale view-entry cleanup.
Clear `item` before retrying and cover the stale-view replacement path in the
existing dictionary unittest.

Coverity CID 425864 (TAINTED_SCALAR): os_read_cpuset_cpus() sized its static buffer from the first caller's system_cpus argument, and startup can first call it with 0. Derive a non-zero CPU baseline when needed and grow the buffer before reading cpuset.cpus so long CPU lists are not truncated into wrong counts or out-of-bounds parsing.

Coverity CID 468190 (CHECKED_RETURN): worker_unregister() freed the last workname even when JudyHSDel() failed, which can leave a freed workname still indexed in the JudyHS table. Only free and account away the workname after a successful delete, and log unexpected JudyHS delete failures.

Coverity CID 457948 (TOCTOU): machine_guid_get_or_create() checked the
registry path with access() before calling mkdir() while startup still runs
with elevated privileges. Use mkdir() with EEXIST handling directly, matching
existing Netdata directory-creation idioms and removing the check/use race.

Coverity CID 439982 (STRING_OVERFLOW): reject AF_UNIX socket paths that do not fit in sun_path before the nofork spawn server stores or uses them. The nofork connect and bind paths now use bounded copies after that validation, fixing both copies of the same root cause.

Coverity CID 410121 (MISSING_LOCK): ml_host_detect_once() reset host->mls before taking host->mutex, while ml_host_stop() and the public readers access the same struct under that mutex. Move the reset into the existing critical section so host stats updates follow one lock discipline.

Coverity CID 410124 (MISSING_LOCK): histogram and timer samples updated
the shared buffer partly outside `m->histogram.ext->mutex` while the flush
path sorted the same buffer under that lock. Keep reset, growth, append, and
flush snapshot on the same mutex so samples are not dropped or read from a
partially synchronized buffer.

Coverity CID 425867 (MISSING_LOCK): use atomic load/store for the shared workers_exit latch in the worker event loop. This removes the unlocked cross-thread race without changing the existing mutex and condition-variable flow.

Coverity CID 439969 (BAD_CHECK_OF_WAIT_COND): the worker loop could miss a
new-job signal after failing to acquire runnable work and then sleep even
though a request was already queued. Scan for runnable jobs and wait under the
same mutex so queued requests cannot be stranded behind a lost wakeup.

Coverity CID 381151 (LOCK): the stored trace points to stale line numbers, but
the current print-tree exit path still called exit() while holding
apps_and_stdout_mutex. Unlock the mutex after printing and before exit() so the
module destructor does not destroy a locked uv_mutex_t.

Coverity CID 393056 (SLEEP): stop holding host->mutex across chart
dictionary traversal in ml_host_detect_once(). Aggregate the host
stats locally and publish them under the mutex so long chart-deletion
waits on the rrdset index do not block ML readers and stop paths for
the full walk.

Coverity CID 393057 (SLEEP): ml_host_stop() held host->mutex while waiting
for the host chart dictionary read lock. Reset the host stats under the
mutex and release it before walking the chart and dimension dictionaries
so lengthy chart-deletion writers do not block ML readers behind the
mutex.

Coverity CID 405089 (SLEEP): Function-triggered eBPF socket restarts held ebpf_exit_cleanup while nd_thread_create could wait and retry. Gate the new thread until state is published, so creation happens outside the cleanup mutex without racing shutdown.

Coverity CID 442107 (SLEEP): remove-stale-node held the global RRD write lock while freeing a host. Unlink the host under the lock, then run teardown/freeing outside the lock so logging and stream shutdown waits do not block global RRD progress.

Coverity CID 405474 (RESOURCE_LEAK): initialize `fd_v2` before
`nd_mmap_advanced()` and close it on both migration failure paths.
This keeps the success-path ownership transfer through
`journalfile_v2_data_set()` unchanged while preventing leaked file
descriptors when mmap setup or journal build fails.

Coverity CID 455300 (RESOURCE_LEAK): start_metadata_hosts() skipped
store_ctx_cleanup_list() once shutdown was requested, leaving a
worker-owned Judy list unreleased after ownership moved out of
metadata_event_loop(). Call the helper unconditionally so shutdown still
frees the list while its internal guard suppresses database work.

Coverity CID 451560 (UNINIT): stop publishing a model when preprocessing yields fewer than two training vectors, because k-means returns with no cluster centers in that case. Also value-initialize inlined cluster centers so empty-source conversions stay deterministic instead of carrying indeterminate dlib matrix bytes.