fix(arena): NULL-arena guard in cbm_arena_alloc; skip vendored/ dirs

- cbm_arena_alloc returns NULL on a NULL arena (both arena.c copies)
  instead of dereferencing it — defense-in-depth against the NULL-arena
  type-allocation path that could crash the LSP type layer.
- discover: add "vendored" to the always-skip directory list.

Distilled from #374, taking the parts not already on main. The PR's
ts_lsp tuple-arena allocation, the C/C++ template formal-count clamp,
and the type_rep unbound-param preservation it also carried all landed
independently in v0.7.0 / via #322 / #360, so only these two
defensive improvements remain. Relates to #390.

internal/cbm/arena.c

@@ -33,7 +33,7 @@ static int arena_grow(CBMArena *a, size_t min_size) {
 }
 
 void *cbm_arena_alloc(CBMArena *a, size_t n) {
-    if (n == 0) {
+    if (!a || n == 0) {
         return NULL;
     }
     // 8-byte alignment

src/discover/discover.c

@@ -44,7 +44,7 @@ static const char *ALWAYS_SKIP_DIRS[] = {
     /* Deploy */
     ".vercel", ".netlify",
     /* Misc */
-    ".qdrant_code_embeddings", ".tmp", "vendor", NULL};
+    ".qdrant_code_embeddings", ".tmp", "vendor", "vendored", NULL};
 
 static const char *FAST_SKIP_DIRS[] = {
     "generated", "gen",           "auto-generated", "fixtures",     "testdata",    "test_data",

src/foundation/arena.c

@@ -56,7 +56,7 @@ static int arena_grow(CBMArena *a, size_t min_size) {
 }
 
 void *cbm_arena_alloc(CBMArena *a, size_t n) {
-    if (n == 0) {
+    if (!a || n == 0) {
         return NULL;
     }
     /* 8-byte alignment */

tests/test_arena.c

@@ -45,6 +45,12 @@ TEST(arena_alloc_zero) {
     PASS();
 }
 
+TEST(arena_alloc_null_arena) {
+    void *p = cbm_arena_alloc(NULL, 16);
+    ASSERT_NULL(p);
+    PASS();
+}
+
 TEST(arena_alloc_alignment) {
     CBMArena a;
     cbm_arena_init(&a);
@@ -426,6 +432,7 @@ SUITE(arena) {
     RUN_TEST(arena_init_sized);
     RUN_TEST(arena_alloc_basic);
     RUN_TEST(arena_alloc_zero);
+    RUN_TEST(arena_alloc_null_arena);
     RUN_TEST(arena_alloc_alignment);
     RUN_TEST(arena_alloc_grows_blocks);
     RUN_TEST(arena_alloc_large_single);

tests/test_discover.c

@@ -37,6 +37,10 @@ TEST(skip_vendor) {
     ASSERT_TRUE(cbm_should_skip_dir("vendor", CBM_MODE_FULL));
     PASS();
 }
+TEST(skip_vendored) {
+    ASSERT_TRUE(cbm_should_skip_dir("vendored", CBM_MODE_FULL));
+    PASS();
+}
 TEST(skip_terraform) {
     ASSERT_TRUE(cbm_should_skip_dir(".terraform", CBM_MODE_FULL));
     PASS();
@@ -680,6 +684,7 @@ SUITE(discover) {
     RUN_TEST(skip_dist);
     RUN_TEST(skip_target);
     RUN_TEST(skip_vendor);
+    RUN_TEST(skip_vendored);
     RUN_TEST(skip_terraform);
     RUN_TEST(skip_coverage);
     RUN_TEST(skip_idea);