whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/neovim/patch/neovim-CLEAN.md

@@ -0,0 +1,24 @@
+# neovim — CLEAN
+
+## Scan Date
+
+2026-03-27
+
+## Files Scanned
+
+- `src/nvim/runtime.c` (runtimepath loading, package autoload)
+
+## Findings
+
+No CWE-407 defects found.
+
+### `ga_loaded` in `script_autoload()`
+
+The `ga_loaded` garray is scanned linearly O(P) to check if a package was
+already loaded. However, `script_autoload()` is called once per function
+resolution, not inside an inner loop. The call site does not create a
+cross-product. This is O(P) per-call, not O(N×P).
+
+### Verdict
+
+CLEAN — no algorithmic complexity defects in scanned code paths.