fix: address re-review — coverage build, chunk OOB guard, UBSan loads, srand scope

- Remove -DSTRICT_WARNINGS=ON from coverage job (_FORTIFY_SOURCE + -O0 + -Werror fatal)
- Fix chunk.c metadata guard: peek at present flag before calling metadata_from_buf
  so the remaining_size check covers the full sizeof(int)+FILE_METADATA_WIRE_SIZE
- Fix chunk.c UBSan misaligned loads: use memcpy instead of *(size_t*)deref
- Move srand(42) to test_property() top level so all property tests are seeded

.gitea/workflows/ci.yaml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Configure
-        run: cmake -B build -S . -DENABLE_COVERAGE=ON -DSTRICT_WARNINGS=ON
+        run: cmake -B build -S . -DENABLE_COVERAGE=ON
 
       - name: Build
         run: cmake --build build -j$(nproc)