go-cluster: traefik-0001/nats-server-0001 CWE-407; grafana/consul/containerd/buildkit/helm/cayley CLEAN

traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)

defects/containerd/patch/CLEAN.md

@@ -0,0 +1,17 @@
+# containerd — CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-29
+
+## Scope
+
+- `cache/refs.go` — `walkUniqueAncestors`/`walkBlobVariantsOnly`: uses
+  `map[digest.Digest]struct{}` visited set for layer graph traversal. Correct O(V+E).
+- `cache/remotecache/v1/` — `addItemToStorage`, `getRemoteChain`: both use
+  `map[*item]*itemWithOutgoingLinks` / `map[int]struct{}` visited guards. Correct.
+- All `slices.Contains` call sites: used on small bounded option/capability slices
+  (mount options, platform lists), never inside a per-item outer loop.
+
+## Verdict
+
+No CWE-407 defects found. containerd's layer deduplication and cache traversal use
+proper hash-map visited guards.