Misc fixes from Coverity and Sonar audits (cleanup batch) - #22299

Sonar c:S3519 (BLOCKER): the reverse-scan loops in
convert_cgroup_to_systemd_service() used `while (len--)` on a `size_t`,
so when the input contained no separator the loop ran to completion and
the post-decrement on len == 0 wrapped to SIZE_MAX. The subsequent
`if (len)` was true and `s[len] = '\0'` wrote far out of bounds.

The dot-search was the explicitly flagged path; the slash-search had the
same wrap pattern but was accidentally benign because `&s[SIZE_MAX + 1]`
wrapped back to `&s[0]`.

Replace both reverse scans with strrchr() and an explicit non-NULL,
non-leading check. Preserves the existing behavior for valid inputs
(separator at index > 0 truncates / repositions; separator at index 0 or
absent leaves the string unchanged) and removes the unsigned-underflow
path.

…anch

Sonar c:S935 (CRITICAL): pubsub_connector_worker() is declared void *,
but the conditional test-only early exit inside #ifdef UNIT_TESTING used
a bare `return;`. Per C99/C11 6.8.6.4, a return without an expression is
only permitted in a function whose return type is void. Production
builds skip this block, but enabling UNIT_TESTING fails to compile.

Same pattern as aws_kinesis.c:214 fixed in the previous commit.

…TING branch

Sonar c:S935 (CRITICAL): exporting_main() is declared void, but the
conditional test-only early exit inside #ifdef UNIT_TESTING used
`return NULL;`, which is invalid for a void-returning function per
C99/C11 6.8.6.4. Production builds skip the block, but enabling
UNIT_TESTING fails to compile.

Change the conditional return to a bare `return;`, and remove the stale
"@return It always returns NULL" line from the function's docstring
(left behind from when the signature was void *).

Together with the previous two commits, this closes the c:S935 trio
across the exporting subsystem (aws_kinesis, pubsub, exporting_engine).

Sonar c:S2612: mark_database_to_recover() created the
.netdata-meta.db.recover / .delete marker with `open(..., O_WRONLY |
O_CREAT | O_TRUNC | O_CLOEXEC, 444)`. The literal `444` is decimal,
which is octal 0o674 (rw-rwxr--) -- group rwx + others r. Same
decimal-not-octal typo as the previous api_v1_manage.c commit.

The file is a marker created and immediately closed (no body written);
only its existence matters at next-startup recovery detection. It does
not need group or other access. Use mode 0600 -- minimum permissions
needed by the owning netdata process, eliminates the c:S2612 violation.

Sonar c:S2612: file_lock_get() created the advisory lock file with
mode 0666 (rw-rw-rw-). Netdata runs as a single dedicated user, so
group/other access is unnecessary and adds latent risk if any local
user can interfere with the lock file.

flock(2) is purely advisory and does not enforce by mode, but the open()
permission still controls who can create/access the file. Owner-only
0600 keeps the locking behavior intact for the netdata user while
preventing unrelated local users from creating or opening the file.

The function is currently unused (its caller in src/daemon/main.c is
commented out), but it is exposed in the public header and may be
revived for single-instance enforcement; tightening the default now
avoids carrying permissive bits forward.

…ine_sanitized

Sonar c:S1751: comm_from_cmdline_sanitized() used `while (start)` to
process the first occurrence of `comm` in the duplicated command-line
buffer, but the body unconditionally returns and `start` is never
updated -- the loop could never iterate twice. Replace with `if (start)`
for accurate intent. No behavior change.

Sonar c:S876: ebpf_update_global_publish() computed
`zombie = exit + (-release_task)` via in-place negation of the unsigned
release_task counter. The unary minus on uint64_t is well-defined
(modular arithmetic) but is a code smell and was unnecessary -- the
intent was simple subtraction.

Replace with a direct `(long)exit - (long)release_task`, matching the
pattern used for `pvc->running` two lines above. Drop the in-place
mutation; the release_task counter is not read elsewhere after this
block. Numerical result is identical.

Sonar c:S876: chart_by_reason() iterated with `size_t i` and passed
`-i` to stream_handshake_error_to_string(STREAM_HANDSHAKE). The unary
minus on the unsigned counter wrapped to a huge unsigned value that
then narrowed to int through implementation-defined conversion (C99
6.3.1.3). It happens to produce the correct -i on two's-complement
platforms but is fragile and unportable.

Change the loop variable to `int`. The loop bound
STREAM_HANDSHAKE_NEGATIVE_MAX is 40, well within int range, and the
b->rd[] array has more than enough entries for the same index. The
negation is now well-defined signed arithmetic.

Sonar go:S3923: sortRethinkRows() switched on sortColumn but the
"durationMs" case and the default branch performed the same descending
sort by DurationMs. RethinkDB only exposes durationMs as a server-side
sort option (the only column with sortOpt: true in
rethinkRunningColumns), so the switch was always going to take one of
two identical paths.

Drop the switch and sort directly. The unused parameter is renamed to
`_` (Go idiom). Behaviour and call shape are unchanged.