digikam: 2 new defects (0003 MOAD-0001, 0004 MOAD-0004); lmms: all 5 MOADs CLEAN

digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and
removeFromXmpTagStringBag call QStringList::contains() inside a loop over
existing entries — O(O*N) per image during batch metadata write.
Fix: build QSet<QString> before the loop for O(1) lookup.
17x speedup at K=200 keywords (unit test PASS).

digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2
token exchange POST body (including client_secret_) via qDebug() at
GrantFlowAuthorizationCode completion — exposes cloud service credentials
in debug logs/stderr for Google Photos, Flickr, OneDrive integrations.
Fix: replace full-body dump with redacted log line.

lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls
are on QHash/QMap/QSet, no credential logging, no leaked thread context,
no unsynchronized cache access.

defects/lmms/patch/lmms-CLEAN.txt

@@ -0,0 +1,31 @@
+SCAN RESULT: CLEAN
+Target: LMMS (Linux MultiMedia Studio)
+URL: https://github.com/LMMS/lmms
+Commit: depth=1 HEAD as of 2026-03-31
+Scanner: agent blackops
+
+MOAD-0001 (CWE-407): CLEAN
+  - std::find in AudioEngine::renderStageNoteSetup (m_playHandlesToRemove x m_playHandles)
+    is O(R*H) but R (handles being removed per frame) is typically O(1); not a loop defect.
+  - Song.cpp recordedModels is QSet — contains() is O(1).
+  - LadspaManager m_ladspaManagerMap.contains() is QMap — O(log N), not a hot loop.
+  - MidiWinMM outDevs.contains() is QStringList but device count is tiny (1-10). Not actionable.
+  - All other contains() calls are on QHash/QMap/QSet containers.
+
+MOAD-0002 (Intertangle): CLEAN (NOTED)
+  - Engine class is a classic static god object (audioEngine, song, mixer, etc.)
+  - This is intentional LMMS architecture, not a new defect pattern to file.
+
+MOAD-0003 (Leaked Context): CLEAN
+  - thread_local s_renderingThread in AudioEngine.cpp is intentional thread identification.
+  - No request-scoped identity stored in thread-local storage.
+
+MOAD-0004 (CWE-312): CLEAN
+  - No credential logging found in src/core/ or plugins/.
+  - Plugin-related "key" log strings refer to musical keys or map keys, not credentials.
+  - CarlaBase/rest-server.cpp logs connection keys (WebSocket, not auth secrets).
+
+MOAD-0005 (Thundering Herd): CLEAN
+  - AudioEngine audio rendering path is single-threaded worker model (AudioEngineWorkerThread).
+  - No unsynchronized cache get+null+put patterns found.
+  - Mixer uses per-channel m_lock correctly.