feat(decompiler): Rec 31 #31-3 RAII Stage 2 — marshal.cc ByteChunk owns its buffer

[CryptoJones]

Converts PackedDecode's inStream chunks from raw-pointer-owning to unique_ptr-owning. The ownership previously lived in the destructor's manual delete[] loop — exactly the leak surface (any exception or early return that bypasses the destructor would leak). After Stage 2 the ownership is local to the chunk itself.

Before:

class ByteChunk {                    // Just two raw pointers
  uint1 *start;
  uint1 *end;
};

// allocateNextInputBuffer():
uint1 *buf = new uint1[BUFFER_SIZE + pad];
inStream.emplace_back(buf, buf+BUFFER_SIZE);

// endIngest() tail-padding:
uint1 *endbuf = new uint1[1];
inStream.emplace_back(endbuf, endbuf+1);

// ~PackedDecode():
for (auto iter = inStream.begin(); iter != inStream.end(); ++iter)
  delete[] (*iter).start;            // Manual cleanup

After:

class ByteChunk {
  unique_ptr<uint1[]> storage;       // Owning storage
  uint1 *start;                      // [start, end) window into storage
  uint1 *end;
};

// allocateNextInputBuffer():
auto owned = make_unique<uint1[]>(BUFFER_SIZE + pad);
uint1 *buf = owned.get();
inStream.emplace_back(move(owned), buf, buf+BUFFER_SIZE);

// ~PackedDecode():
// empty — unique_ptr cleans up per chunk

ByteChunk becomes move-only (unique_ptr has no copy ctor). list::emplace_back constructs in-place, so no copy is required for the inStream usage pattern.

Behavior preserved:

• start / end pointers still expose the same [start, end) byte window; consumers (getNextByte, advancePosition, the inStream iterator walk in Position) are read-only and unchanged.
• The endIngest tail-pad case still allocates a 1-byte chunk and writes ELEMENT_END at offset 0.
• Lifetime of the buffer still matches the chunk's lifetime, which still matches the PackedDecode's lifetime via inStream.

Audit gate: marshal.cc and marshal.hh added to cppRaiiAudit.gradle's PROTECTED_FILES. Stage 1 (#31-2) already gated address.cc, space.cc, rangeutil.cc; Stage 2's marshal pair joins them. xml.cc / xml.y (the yacc-generated parser's bison-source-level edits) come in a follow-up PR — those raw news live in regenerated parser actions, not in hand-written code, and need a separate bison-source-level approach.

Note: make_unique<uint1[]>(N) value-initializes (zeroes) the buffer, whereas new uint1[N] did not. The buffer is overwritten by s.get((char *)buf, BUFFER_SIZE+1, '\0') before any read; the zero-init cost is one memset per chunk (BUFFER_SIZE bytes typically), negligible relative to the I/O it precedes.

Closes #31-3 (marshal half) of Rec 31. xml.y / xml.cc remain open.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/