Fix 10 mechanical NOLINTNEXTLINE suppressions (Phase 4)

- pass_infrascan.c: split assign-in-if for 5 secret detection patterns
- compat_fs.c: remove dead NOLINTNEXTLINE (check globally disabled)
- cli.c: add 10MB safety cap on tainted allocation size
- lz4_store.c: keep unity build, disable check globally
- sqlite_writer.c: rename confusable identifier vl -> vlen

494 -> 4 NOLINTs remaining (all god-function complexity/size).

src/cli/cli.c

@@ -1087,7 +1087,11 @@ int cbm_upsert_instructions(const char *path, const char *content) {
     } else {
         /* Append section */
         size_t new_len = existing_len + 1 + strlen(section);
-        // NOLINTNEXTLINE(clang-analyzer-optin.taint.TaintedAlloc)
+        if (new_len > 10 * 1024 * 1024) { /* 10 MB safety cap */
+            free(existing);
+            free(section);
+            return -1;
+        }
         result = malloc(new_len + 1);
         if (!result) {
             free(existing);