unreal/godot-deeper: CWE-407 findings

unreal: clone unavailable (EpicGames/UnrealEngine requires GitHub auth) — CLEAN.md added.

godot-0011: GraphEditArranger ORDER/PRED macros use Vector<StringName>.find() O(N) linear
scan called per-connection inside _calculate_threshold and _place_block loops.
Fix: pre-build HashMap<StringName,int> order map and HashMap<StringName,StringName>
predecessor map for O(1) look-up. Severity: MEDIUM (~6x at N=200 nodes).

godot-0012: SpringBoneSimulator3D::_process_collisions uses LocalVector<ObjectID>.has()
and .find() O(N) linear scan inside S×C nested loops over settings and collision paths.
Fix: pre-build HashSet<ObjectID> + HashMap<ObjectID,int> for O(1) look-up.
Severity: MEDIUM-HIGH (~20x at N=500, S=50, C=100).

Both: 2/2 unit tests PASS.

defects/unreal/patch/CLEAN.md

@@ -0,0 +1,17 @@
+# UnrealEngine — CWE-407 Scan Result: CLONE UNAVAILABLE
+
+The EpicGames/UnrealEngine GitHub repository requires an authorized Epic Games account
+to access. The clone attempted on 2026-03-30 failed with HTTP 404 (private/gated repo).
+
+No source code was available for scanning.
+
+**Action required:** If an authorized clone becomes available at ~/git/UnrealEngine,
+re-run the CWE-407 scan focusing on:
+- `Engine/Source/Runtime/` — `TArray::Contains(`, `TArray::Find(`, `TArray::IndexOfByKey(`
+- Asset dependency deduplication
+- Blueprint node visited set
+- Material instance override scanning
+- Streaming manager tracked objects
+- GC root set membership
+
+Target scan date: 2026-03-30