Move version-specific cppcheck suppressions to --suppress flags for cross-OS compatibility

Author: DeusData

.cppcheck

@@ -1,36 +1,15 @@
 # cppcheck suppressions file
-#
-# Suppress false positives and checks not relevant to our codebase.
-# Philosophy: suppress as little as possible.
+# Only universally-supported suppression IDs here.
+# Version-specific IDs go in Makefile.cbm as --suppress flags.
 
-# We use _Thread_local extensively — cppcheck doesn't fully understand it
-threadsafety:*
-
-# Vendored code (tree-sitter grammars, yyjson, sqlite3)
+# Vendored code
 *:internal/cbm/vendored/*
 *:vendored/*
 
-# Test framework uses some patterns cppcheck doesn't like
+# Test framework patterns
 unusedFunction:tests/*
 
-# We intentionally use variable-length printf format strings
-formatStringUsedSafely
-
-# OOM handling: CLI tool — crash is acceptable on allocation failure.
-# Real bugs (unsafe realloc) are fixed; these are about NULL deref after
-# malloc/calloc which on modern systems means the process is dying anyway.
-nullPointerOutOfMemory
-nullPointerArithmeticOutOfMemory
-ctunullpointerOutOfMemory
-
-# Intentional (void*)1 sentinel pattern for hash table presence checks
-intToPointerCast
-
-# cbm_log_info() uses NULL sentinel — macro adds it automatically
-varFuncNullUB
-
-# Const correctness for vendor API types (yyjson, sqlite) — adding const
-# requires casts against their APIs. Low value, high churn.
+# Intentional patterns
 constVariablePointer
 constParameterPointer
 constVariable

Makefile.cbm

@@ -440,6 +440,12 @@ lint-cppcheck:
 		--error-exitcode=1 \
 		--inline-suppr \
 		--quiet \
+		--suppress=varFuncNullUB \
+		--suppress=intToPointerCast \
+		--suppress=nullPointerOutOfMemory \
+		--suppress=nullPointerArithmeticOutOfMemory \
+		--suppress=ctunullpointerOutOfMemory \
+		--suppress='nullPointer:internal/cbm/sqlite_writer.c' \
 		-Isrc -Ivendored -Ivendored/sqlite3 \
 		-I$(CBM_DIR) -I$(TS_INCLUDE) \
 		$(LINT_SRCS)