[franciscbalint]

Second re-audit (2026-11-12) fixes.

• The streaming download now checks write errors, rejects a JSON object body whatever its content type, and deletes the partial file. Before, a JSON error body was saved as the file, and a write that hit a file-size limit still reported success.
• All downloads reject a JSON object body instead of saving it.
• gcc 15 -Wformat-overflow: the column buffer (int_str_option[10]) is now 16 bytes and filled with snprintf. Four warnings in a Release build on Ubuntu 26.04 are gone; an INT_MIN/INT_MAX test is added (it crashed the macOS fortify build before the fix).
• Second commit: CodeQL uses a manual build with a config file; the Dockerfile moves to Ubuntu 26.04.

Tests 114+4 → 116+7 on macOS, Ubuntu 24.04 and 26.04, and the CMake 3.21.0 floor.