Branch coverage push (waves 2,7,8) + 5 src/ bug fixes surfaced by tests

[ser-vasilich]

Summary

Branch coverage push across 30+ src/ files, surfacing and fixing 5 latent
bugs along the way.

Coverage delta (src/, excl. test/):

Metric	Master	This PR	Δ
Branches	~66.1%	68.58%	+2.5pp
Regions	~82.8%	84.91%	+2.0pp
Lines	~87.2%	89.07%	+1.9pp
Functions	~97.3%	98.50%	+1.2pp
Tests	2855	3231	+376

Bug fixes (5 new, all found by coverage tests)

1. fix(system): qsort(NULL, 0, ...) UB in .os.list — ray_os_list_fn
   called qsort on an empty-directory result; C11 §7.22.5.2/2 makes that
   UB even with nmemb == 0 (UBSan trips on the nonnull attr). Guard
   with if (count > 0).
2. fix(env): ray_setenv_fn under-retained its val arg → caller
   over-released → freed slot reused by next allocation → spurious "type"
   error on a later unrelated op (manifested as (set X (table …))
   failing after setenv + getenv). Add ray_retain(val) to match the
   ray_quote_fn convention.
3. fix(env): pooled ray strings passed unterminated to libc getenv/setenv — ray strings >12 chars are not NUL-terminated; libc reads OOB.
   Copy into a stack buffer first.
4. fix(expr): (int64_t)1 << 63 UB in the i64 DIV/MOD overflow guard
   (INT64_MIN / -1). Replace with INT64_MIN.
5. fix(query): int32 overflow in xbar near INT32_MIN — q * b32
   transient overflowed during the floored-bucket computation. Hoist to
   int64, truncate on store.
6. fix(vec): memcpy(dst, NULL, 0) UB in ray_vec_from_raw — guard
   if (data_size) and reject NULL with non-zero size.

Test additions (≈30k+ lines across waves)

• Wave 2: 13 src/ops/ files (strop, filter, idiom, tblop, pivot, window,
  collection, join, datalog, fused_group, graph, idxop, fvec)
• Wave 3-5 (committed earlier together with the bug fixes): query, group,
  expr, traverse, linkop, rowsel, journal, fuse, eval, csv, vec, dict, col,
  heap, parse, csr, part, table
• Wave 7: push hll.c / timer.c / idxop.c / fused_group.c / group.c to
  ≥80% region / function / line:
  • hll.c: region 21 → 90.75%, function 60 → 100%, line 33.5 → 96.56%
  • timer.c: region 53.3 → 95.83%, function 61.5 → 100%, line 59.1 → 100%
  • idxop.c: region 68.3 → 89.37%, function 85 → 100%, line 69.6 → 94.86%
  • fused_group.c: region 73.7 → 80.10%, function 92.2 → 100%, line 76.7 → 84.99%
  • group.c: region 78.83 → 80.16%, line 86.05 → 87.28%
• Wave 8 (2nd pass on remaining branch-coverage gaps):
  query +1.0pp, fused_group +1.57pp, group +0.45pp, traverse +0.52pp, eval +0.14pp.

Post-rebase test-rename fixups: timer → .time.now, args → .sys.args.

Test plan

• make test (ASan+UBSan debug): 3231 of 3233 pass, 2 skipped, 0 failed, 0 sanitizer errors
• Each src/ fix has a regression test (sum-of-error-prop / sel_compact MAPCOMMON / setenv refcount / 1<<63 mod overflow / xbar near INT32_MIN / from_raw NULL / .os.list empty dir)
• No src/ de-static, no internal-header exposure for tests
• All static inline instantiations / inline accounting artifacts documented inline

Commits

b19edab1 fix(system): skip qsort on empty directory in .os.list
f9d3b1b6 test(branches): wave 8 — 2nd pass on query/group/fused_group/eval/traverse
ce018965 test(system): update args→.sys.args after master rename
283dfcc6 test(branches): wave 7 — push hll/timer/idxop/fused_group/group to ≥80% all metrics
3ff3120c test(system): swap `timer` → `.time.now` post-rebase
93a1fe20 fix(env/expr/query/vec): 4 bugs surfaced by wave 3-5 coverage push
a7fd1039 test(branches): wave 2 — coverage push across 13 more src/ops/ files

🤖 Generated with Claude Code