[Sk1tch]

Cppcheck reports missing headers and unsupported macros even when it exits zero. The C++ security pipeline treated those results as complete AST coverage. Its normalizer also matched the gets substring inside the missing include Widgets/Input/SVirtualJoystick.h as an unsafe C call.

Require identifier boundaries around unsafe API names. Treat cppcheck configuration failures as incomplete security analysis, activating the existing per-file retries and regex fallback. This complements #864, which handles the code-diagnostic phase; phase-level changes are left in that existing PR.

Validation: all C++ plugin tests pass, including regressions for unsafe API boundaries and retained regex security detection after a zero-exit configuration failure. The originating controller reports incomplete analysis instead of a fabricated unsafe-string finding. The core suite has 5,808 passes, 5 skips, and two instances of an existing review-prompt failure, also reproduced on the unchanged upstream module.