go-cluster: traefik-0001/nats-server-0001 CWE-407; grafana/consul/containerd/buildkit/helm/cayley CLEAN

traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)

defects/consul/patch/CLEAN.md

@@ -0,0 +1,21 @@
+# consul — CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-29
+
+## Scope
+
+- `agent/consul/discoverychain/` — service discovery chain compilation: uses
+  `map[string]struct{}` for visited sets and a proper `stringStack` (slice with Push/Pop).
+  No O(N²) membership checks.
+- `agent/structs/` — config entry validation: uses `map[string]bool` / `map[string]struct{}`
+  for seen-address dedup.
+- `agent/xds/` — Envoy cluster/listener building: uses `map[string]struct{}` for dedup.
+- `internal/go-sso/` — `StrListContains` usage: only called on small, bounded slices (3-element
+  localhost list, short allowed-URI lists). Not inside a loop.
+- `lib/stringslice/Contains` — all call sites checked; none inside an outer loop over the same
+  or related collection.
+
+## Verdict
+
+No CWE-407 defects found. Consul's service graph and discovery chain use proper hash-set
+visited structures throughout.