fix(reachability): announce a target that is never called (finding B)

[GuilhermeBn198]

Finding B, measured

Finding B was logged in August as a structural suspicion: TargetPass instruments call sites whose callee matches --target-function-name, and a program does not call its own main, so nothing gets instrumented. The CASTLE v6 baseline turns the suspicion into a number.

98 of 217 runs (45%) went through --target-function --target-function-name main:

verdict	n
TRUE	57
TIMEOUT	22
UNKNOWN	10
ERROR	9
FALSE-*	0

Not one FALSE. That is not scarcity — across the same 217 runs the other modes produce 49 FALSE-* verdicts. This mode is the only one that never accuses anything.

59 of those 98 programs were known to be vulnerable. Zero were detected.

The scoring damage has two sides, and the second is the uncomfortable one:

	effect
5 FN	guaranteed misses — the oracle could not have got them right
12 TN	credit for answers an oracle that can only say "correct" could not have failed to give

Excluding the mode entirely: recall 74.0% → 79.4%, precision unchanged at 98.2% (the mode yields neither TP nor FP). So B does not inflate precision — it depresses recall and inflates TN.

Correcting an earlier reading of mine: the 61 N/A rows are N/A because the harness declares those CWEs out of scope, not because of finding B. B's real cost is the 17 scored cases.

What this PR changes

Zero call sites is not an error. If a program genuinely never calls reach_error, then "the error is unreachable" is the right answer and TRUE is correct. The defect is that such a TRUE is indistinguishable in the output from a TRUE earned by exploring the program.

So the fix is visibility, not verdicts. TargetPass scans the module once and, when the target has no call sites, says what the verdict is worth there:

[map2check] WARNING: target function 'main' is never called in this module.
TargetPass instruments call sites, so nothing was instrumented and the
reachability property holds trivially: a TRUE verdict here means the target
is absent, not that the program is safe.

Reported once per module rather than once per function — this is a function pass with no module-entry hook, and opt runs once per invocation.

Tests

tests/integration/test_target_coverage.sh, wired into the regression job. Four assertions, and it asserts both directions — a warning that always fires is as useless as one that never does:

PASS a called target stays quiet
PASS an uncalled target announces itself
PASS the warning names the target it is about
PASS the warning says what a TRUE verdict is worth here

Verified against a full build and install, not the pass in isolation.

Deliberately not in this PR

The CASTLE harness maps 13 CWEs onto this mode as an escape default (tests/castle/run_castle_evaluation.sh:34-47). That is the other half of finding B, and fixing it changes baseline scoring — so it waits for the v6 run to finish. Changing the scoring criterion mid-run is exactly what makes two measurements incomparable.

Docs

• docs/reports/2026-08-12-castle-juliet-findings.md — new §2.1 with the measurement.
• docs/TESTCOMP-CHECKLIST.md — refreshed: K moved to fixed, B promoted to High with its number, the three image defects from fix(docker): build Clam with clang-16, and validate Dockerfile.dev on PRs #58/chore(docker): pin Clam and its three dependencies to SHAs #59 recorded, v6 status updated. It also now records why K measured as zero effect on CASTLE: finding B masks it, since a mode that never records a violation gives K nothing to rescue.