fix: address reviewer issues in cross_project_links handler

- Close sqlite3 handle on open_v2 failure (was leaking db handle)
- Return cbm_mcp_text_result on malloc failure instead of NULL
- Reduce safety break from 60000 to 58000 for memmove headroom

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Shidfar

src/mcp/mcp.c

@@ -3379,6 +3379,7 @@ static char *handle_cross_project_links(cbm_mcp_server_t *srv, const char *args)
 
     sqlite3 *db = NULL;
     if (sqlite3_open_v2(db_path, &db, SQLITE_OPEN_READONLY, NULL) != SQLITE_OK) {
+        if (db) sqlite3_close(db);
         return cbm_mcp_text_result(
             "No cross-project links found. Index at least 2 projects first.", false);
     }
@@ -3436,7 +3437,8 @@ static char *handle_cross_project_links(cbm_mcp_server_t *srv, const char *args)
     /* Format output */
     enum { XL_BUF_SIZE = 65536 };
     char *buf = malloc(XL_BUF_SIZE);
-    if (!buf) { sqlite3_finalize(stmt); sqlite3_close(db); return NULL; }
+    if (!buf) { sqlite3_finalize(stmt); sqlite3_close(db);
+                 return cbm_mcp_text_result("alloc failed", true); }
     int pos = 0;
     int total = 0;
     char cur_protocol[64] = {0};
@@ -3472,7 +3474,7 @@ static char *handle_cross_project_links(cbm_mcp_server_t *srv, const char *args)
             pcons ? pcons : "", qcons ? qcons : "", fcons ? fcons : "");
         total++;
 
-        if (pos > 60000) break;  /* safety limit */
+        if (pos > 58000) break;  /* safety limit — leave headroom for header prepend */
     }
 
     sqlite3_finalize(stmt);