Fix all memory leaks + Docker test infra gaps

Leaks fixed (5506 bytes → 0):
- sqlite3_open_v2 allocates handle even on CANTOPEN — must call
  sqlite3_close before freeing struct (4x 792 bytes, 32 indirect)
- graph_buffer node_by_id: reuse existing heap key on hash table
  replace to avoid leak (2 bytes)

Docker test infrastructure:
- python3 (full) instead of python3-minimal (missing json module)
- git installed (19 tests were silently skipped)
- sqlite3_close_v2 + sqlite3_shutdown at test exit

Author: DeusData

src/graph_buffer/graph_buffer.c

@@ -335,7 +335,14 @@ int64_t cbm_gbuf_upsert_node(cbm_gbuf_t *gb, const char *label, const char *name
 
     char id_buf[32];
     make_id_key(id_buf, sizeof(id_buf), id);
-    cbm_ht_set(gb->node_by_id, strdup(id_buf), node);
+    /* Check if key exists — if so, reuse old heap key to avoid leak.
+     * cbm_ht_set replaces key pointer, leaking old strdup'd key. */
+    const char *existing_key = cbm_ht_get_key(gb->node_by_id, id_buf);
+    if (existing_key) {
+        cbm_ht_set(gb->node_by_id, existing_key, node);
+    } else {
+        cbm_ht_set(gb->node_by_id, strdup(id_buf), node);
+    }
 
     /* Secondary indexes */
     node_ptr_array_t *by_label = get_or_create_node_array(gb->nodes_by_label, label ? label : "");
@@ -771,7 +778,12 @@ int cbm_gbuf_merge(cbm_gbuf_t *dst, cbm_gbuf_t *src) {
             cbm_ht_set(dst->node_by_qn, node->qualified_name, node);
             char id_buf[32];
             make_id_key(id_buf, sizeof(id_buf), node->id);
-            cbm_ht_set(dst->node_by_id, strdup(id_buf), node);
+            const char *old_id_key = cbm_ht_get_key(dst->node_by_id, id_buf);
+            if (old_id_key) {
+                cbm_ht_set(dst->node_by_id, old_id_key, node);
+            } else {
+                cbm_ht_set(dst->node_by_id, strdup(id_buf), node);
+            }
 
             /* Secondary indexes */
             node_ptr_array_t *by_label =

src/store/store.c

@@ -378,7 +378,8 @@ cbm_store_t *cbm_store_open_path_query(const char *db_path) {
     /* Open read-write but do NOT create — returns SQLITE_CANTOPEN if absent. */
     int rc = sqlite3_open_v2(db_path, &s->db, SQLITE_OPEN_READWRITE, NULL);
     if (rc != SQLITE_OK) {
-        /* File does not exist or cannot be opened — return NULL without creating. */
+        /* sqlite3_open_v2 allocates a handle even on failure — must close it. */
+        sqlite3_close(s->db);
         free(s);
         return NULL;
     }
@@ -513,7 +514,9 @@ void cbm_store_close(cbm_store_t *s) {
     finalize_stmt(&s->stmt_delete_file_hash);
     finalize_stmt(&s->stmt_delete_file_hashes);
 
-    sqlite3_close(s->db);
+    /* Use sqlite3_close_v2 — auto-deallocates when last statement finalizes.
+     * Prevents ASan false-positive leaks from sqlite3 internal state. */
+    sqlite3_close_v2(s->db);
     free((void *)s->db_path);
     free(s);
 }

src/ui/embedded_assets.c

@@ -13,7 +13,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc g++ make \
     zlib1g-dev \
     pkg-config \
-    python3-minimal \
+    python3 \
+    git \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /src

test-infrastructure/Dockerfile

@@ -308,7 +308,8 @@ TEST(arena_strndup_len_exceeds_string) {
 TEST(arena_sprintf_empty_format) {
     CBMArena a;
     cbm_arena_init(&a);
-    char *s = cbm_arena_sprintf(&a, "");
+    /* Use "%s" with empty string — GCC rejects literal "" as format (-Wformat-zero-length) */
+    char *s = cbm_arena_sprintf(&a, "%s", "");
     ASSERT_NOT_NULL(s);
     ASSERT_STR_EQ(s, "");
     ASSERT_EQ(strlen(s), 0);

tests/test_arena.c

@@ -9,6 +9,7 @@ int tf_fail_count = 0;
 int tf_skip_count = 0;
 
 #include "test_framework.h"
+#include <sqlite3.h>
 
 /* Forward declarations of suite functions */
 extern void suite_arena(void);
@@ -147,5 +148,7 @@ int main(void) {
     /* Integration (end-to-end) */
     RUN_SUITE(integration);
 
+    /* Release sqlite3 internal caches so ASan doesn't report them as leaks */
+    sqlite3_shutdown();
     TEST_SUMMARY();
 }