Clean cppcheck findings

[SS-42]

Summary

• parse ZIP local-header sizes through explicit little-endian helpers and size_t allocation bounds
• reject truncated ZIP entries without narrowing 32-bit size fields through int arithmetic
• remove unreachable null checks in Cypher IS NULL / IS NOT NULL evaluation after the existing null guard

Observed locally on macOS 26.5.2 (Darwin 25.5.0, arm64) with Cppcheck 2.21.0 and Homebrew clang-format 22.1.8.

Tests

• scripts/lint.sh --ci
• make -f Makefile.cbm build/c/test-runner CC=clang CXX=clang++
• ASAN_OPTIONS=detect_leaks=0 ./build/c/test-runner cli cypher