blockchain-p2p: solang/tor/bitcoin/transmission/libtorrent/solc CWE-407 scan

solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
  src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
  for each event per function; fix: IndexSet (already a dependency) for O(1) dedup

tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
  Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
  Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
  Transmission: bitfields for piece tracking, sorted binary search for string table
  libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
  solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph

defects/transmission/patch/CLEAN.md

@@ -0,0 +1,18 @@
+# CLEAN — Transmission (BitTorrent client)
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity / linear scan membership).
+
+## Areas Checked
+
+- `libtransmission/peer-mgr.cc` — peer management: no O(N²) peer dedup found.
+  Peer lookups use `std::ranges::find_if` on short request queues (capped by protocol
+  limits), not unbounded lists.
+- `libtransmission/piece-picker` — piece selection: uses bitfields (`tr_bitfield`)
+  for have/want tracking — O(1) per-piece test.
+- `libtransmission/announcer-udp.cc` — tracker UDP responses: `find_if` over active
+  connections, bounded by open tracker count (small constant).
+- `libtransmission/web.cc` — HTTP connection pooling: `find` over `easy_pool_` keyed
+  by hostname string — map-like lookup by string key.
+- `libtransmission/watchdir.cc` — `handled_` is an `std::set<std::string>` — O(log N).
+
+**Result: No actionable CWE-407 defects found. Transmission uses bitfields for
+piece tracking and std::set for deduplication where needed.**