Fix memory-safety and correctness bugs surfaced by Coverity audit (part 1) (#22266)

* daemon: remove machine guid access precheck Coverity CID 457948 (TOCTOU): machine_guid_get_or_create() checked the registry path with access() before calling mkdir() while startup still runs with elevated privileges. Use mkdir() with EEXIST handling directly, matching existing Netdata directory-creation idioms and removing the check/use race. * sqlite: clamp alert non_clear_duration for aclk Coverity CID 440042 (INTEGER_OVERFLOW): health_alarm_log_populate() read non_clear_duration from SQLite directly into the uint32_t ACLK field. Clamp negative values to 0 and oversized values to UINT32_MAX before serializing alert log entries. * worker_utilization: handle JudyHSDel failure Coverity CID 468190 (CHECKED_RETURN): worker_unregister() freed the last workname even when JudyHSDel() failed, which can leave a freed workname still indexed in the JudyHS table. Only free and account away the workname after a successful delete, and log unexpected JudyHS delete failures. * daemon: verify machine guid path is a directory on EEXIST mkdir() returning EEXIST can mean either an existing directory (the case we want to accept) or an existing non-directory file at the same path. Treat the latter as a failure so callers get a clear error instead of ENOTDIR on subsequent writes. * worker_utilization: zero-initialize JError_t on the JudyHSDel path Initialize the local `JError_t` so the `JU_ERRNO` / `JU_ERRID` values logged on a JudyHSDel() JERR return are always defined, even if Judy leaves the struct partially populated in some future path. * sqlite: free metadata cleanup list on shutdown Coverity CID 455300 (RESOURCE_LEAK): start_metadata_hosts() skipped store_ctx_cleanup_list() once shutdown was requested, leaving a worker-owned Judy list unreleased after ownership moved out of metadata_event_loop(). Call the helper unconditionally so shutdown still frees the list while its internal guard suppresses database work. * sqlite: fix pending uuid deletion leak on shutdown Coverity CID 471887 (RESOURCE_LEAK): metadata workers transferred pending_uuid_deletion out of the event loop, but skipped do_pending_uuid_deletion() after shutdown started. Always run the helper so shutdown still frees the Judy list and queued UUIDs, while keeping metadata cleanup disabled during shutdown. * dbengine: close migrated journal fds on failure Coverity CID 405474 (RESOURCE_LEAK): initialize `fd_v2` before `nd_mmap_advanced()` and close it on both migration failure paths. This keeps the success-path ownership transfer through `journalfile_v2_data_set()` unchanged while preventing leaked file descriptors when mmap setup or journal build fails. * systemd-journal: fix duplicate scan dir handle leak Coverity CID 459644 (RESOURCE_LEAK): nd_journal_directory_scan_recursively() opened a directory before checking whether it had already been scanned. Close the duplicate-path DIR handle on the early-return path so repeated directories do not leak file descriptors. * health: fix malformed ${label:...} parsing Coverity CID 439996 (INTEGER_OVERFLOW): only process `${label:...}` placeholders when the token is complete and ends with `}`. This prevents the label-name truncation math from indexing before the local buffer on unterminated placeholders. * systemd-journal: guard dictionary_set() NULL return in recursive scan Treat a NULL return from dictionary_set() the same as an existing entry: close the opendir() handle and return, so the directory descriptor is not leaked if the dict insertion fails. * contexts: clone alert config keys to avoid stack-escape UAF alerts_v2_insert_callback() created `t->configs` with DICT_OPTION_NAME_LINK_DONT_CLONE. alerts_v2_add() then inserted a UUID derived from nd_uuid_unparse_full() into the dictionary — but the buffer holding that UUID was a local on the caller's stack. In LINK_DONT_CLONE mode the dictionary stores the caller pointer verbatim, so every inserted key became a dangling stack reference as soon as alerts_v2_add() returned. Later dictionary operations (including dictionary_destroy()) would then dereference freed stack memory via strlen(item->caller_name), a use-after-free on the /api/v2/alerts path. Drop DICT_OPTION_NAME_LINK_DONT_CLONE from the `t->configs` dictionary so names are cloned into stable storage. `t->nodes` is left unchanged because its names come from persistent rrdhost->machine_guid strings, not from stack buffers. Related: Coverity CID 414658 flagged an OVERRUN on the insertion line; the trace itself was a tool-model FP against the commented-out XXH3 hashtable path, but investigating it surfaced this real stack-escape lifetime bug. * claim: free split-file claim buffers Coverity CID 442342 (RESOURCE_LEAK): release the token and rooms buffers returned by read_by_filename() after claim_agent_from_split_files() finishes using them. This normal-exit cleanup also fixes sibling CID 442346, which reports the same leak root cause for rooms. * daemon: fix thread id in deadly signal log Coverity CID 457745 (STRING_OVERFLOW): the reported overflow is not real because strcatz() bounds the buffer, but the same log path dropped the thread id by not advancing len after print_uint64(). Update len after the integer write so the fatal signal message preserves the thread id. * functions_evloop: make workers_exit checks atomic Coverity CID 425867 (MISSING_LOCK): use atomic load/store for the shared workers_exit latch in the worker event loop. This removes the unlocked cross-thread race without changing the existing mutex and condition-variable flow. --------- Co-authored-by: Costa Tsaousis <costa@netdata.cloud>