game-engines: allegro5/bullet3/box2d/dry CWE-407 scan

bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)

defects/dendrite/patch/CLEAN.md

@@ -0,0 +1,16 @@
+# dendrite — CWE-407 Scan: CLEAN
+
+Scanned: 2026-03-29
+
+## Scope
+
+- `roomserver/internal/query/query.go` — GetAuthChain: `authEventsMap = make(map[string]gomatrixserverlib.PDU)` (map-based dedup)
+- `roomserver/internal/helpers/auth.go` — GetAuthEvents, loadAuthEvents: map-based
+- `roomserver/internal/input/input_events.go` — fetchAuthEvents: map-based
+- Federation auth chain traversal throughout: all use Go `map[string]T` for O(1) key lookup
+
+## Verdict
+
+No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
+All room auth chain and event DAG traversal in Dendrite uses Go `map` for O(1)
+deduplication. No slice-based linear scans in hot traversal paths.