fix: address re-review — coverage build, chunk OOB guard, UBSan loads, srand scope

- Remove -DSTRICT_WARNINGS=ON from coverage job (_FORTIFY_SOURCE + -O0 + -Werror fatal)
- Fix chunk.c metadata guard: peek at present flag before calling metadata_from_buf
  so the remaining_size check covers the full sizeof(int)+FILE_METADATA_WIRE_SIZE
- Fix chunk.c UBSan misaligned loads: use memcpy instead of *(size_t*)deref
- Move srand(42) to test_property() top level so all property tests are seeded

.gitea/workflows/ci.yaml

@@ -89,8 +89,8 @@ jobs:
 
       - name: Coverage Report
         run: |
-          lcov --capture --directory build --output-file coverage.info --branch-coverage
-          lcov --remove coverage.info '/usr/*' '*/tests/*' '*/_deps/*' --output-file coverage.info --branch-coverage --ignore-errors unused
+          lcov --capture --directory build --output-file coverage.info --branch-coverage --ignore-errors negative
+          lcov --remove coverage.info '/usr/*' '*/tests/*' '*/_deps/*' --output-file coverage.info --branch-coverage --ignore-errors unused,negative
           lcov --list coverage.info
 
   valgrind: