[mdns] Add CI check for potential service deadlock

[david-cermak]

Related to #1086

---

Note

Low Risk
CI and offline static analysis only; no runtime or locking behavior changes in the mDNS component.

Overview
Adds automated CI coverage for mDNS service-lock safety so changes that could self-deadlock under MDNS_SERVICE_LOCK / mdns_priv_service_lock are caught before merge.

A new check_lock_safety job in mdns__host-tests.yml (same mdns label / push triggers as other host jobs) installs tree-sitter and runs components/mdns/ci/check_lock_reentry.py on components/mdns.

The new script parses all component .c files, builds a call graph, and fails the job if it finds unbalanced lock/unlock in non-wrapper functions or call chains from code already between lock and unlock into another lock acquirer (potential re-entry deadlock). It prints deduplicated paths and exits non-zero on issues.

^{Reviewed by Cursor Bugbot for commit 0c4e63c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 0c4e63c. Configure here.}

[cursor]

Conditional unlock clears lock region

Medium Severity

_extract_calls_and_lock_regions keeps a single in_locked_region flag while walking every call in each statement. Any unlock in the tree—including on optional early-return branches—clears the flag for the rest of the function, so later statements still under the lock are not recorded in locked_calls and re-entry analysis skips them.

 

^{Reviewed by Cursor Bugbot for commit 0c4e63c. Configure here.}