game-engines: allegro5/bullet3/box2d/dry CWE-407 scan

bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)

defects/dgl/patch/CLEAN.md

@@ -0,0 +1,18 @@
+# dgl — CWE-407 Scan: CLEAN
+
+Scanned: 2026-03-29
+
+## Scope
+
+- `python/dgl/traversal.py` — BFS/DFS: delegates to C++ backend, no Python-level visited list
+- `python/dgl/nn/pytorch/explain/subgraphx.py` — MCTS node selection: no visited list
+- `python/dgl/graphbolt/impl/ondisk_dataset.py` — dataset loading: no graph traversal
+- `python/dgl/graphbolt/internal/utils.py` — utility functions: no membership checks
+- `python/dgl/nn/pytorch/network_emb.py` — random walk sampling: delegates to C++
+
+## Verdict
+
+No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
+Core graph traversal (BFS, DFS, topological sort) is implemented in the C++
+backend. Python-level code uses no list-based visited/seen patterns in hot
+paths.