fix(testsuite): resize crr_build_config caller arrays -- bug-1977

The external-license-resources E2 fixture builder crr_build_config
registers five resources and four distributions, writing resources[4],
dists[3] and vals[4]. All four caller test functions declared only
resources[4]/dists[3]/vals[4], so every build_config call wrote past
the caller's stack arrays -- deterministic ASAN stack-buffer-overflow,
the whole controller suite (137 fixtures) red since 2fcacac2.

Resize the four caller arrays to match the builder's sizing
(resources[5]/dists[4]/vals[5]) with a bug-1977 comment on the sizing
contract. No production code touched.

Verified: src/tools/xce-build.sh controller (asan) 6/6 OK, controller
suite 91s green; buglog record .wolf/bugs/bug-1977.md.

Co-Authored-By: Claude Code <noreply@anthropic.com>

.wolf/bugs/bug-1977.md

@@ -0,0 +1,85 @@
+---
+id: "bug-1977"
+status: "fixed"
+status_updated: "2026-10-28"
+status_note: ""
+component: "controller"
+severity: "crash"
+timestamp: "2026-10-28T11:56:58Z"
+last_seen: "2026-10-28T11:56:58Z"
+occurrences: 1
+files: ["src/controller/testsuite/test_config_resource_reconcile.c"]
+tags: ["testsuite", "asan"]
+related: []
+fix_commits: ["8c1995c2"]
+---
+
+# bug-1977: crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow
+
+## Description
+**Observed:**
+```
+ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...
+WRITE of size 8 at 0x7ffc... thread T0
+    #0 crr_build_config testsuite/test_config_resource_reconcile.c:126   (dists[3] = &d4)
+    #1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161
+```
+Every test in the file that calls `crr_build_config` crashes the same way;
+the full controller suite reports 137/137 FAIL (meson reports each fixture
+crash as its own failure).
+
+**Expected:** all four callers pass arrays large enough for the builder's
+fixtures; the suite stays green.
+
+**Impact:** the whole controller testsuite was unrunnable under ASAN since the
+external-license-resources test fixtures landed (commit 2fcacac2) -- any
+regression in the suite was invisible behind the deterministic crash.
+
+**Found by:** ASAN -- full regression build for the license-resource feature
+(`src/tools/xce-build.sh controller`, profile=asan).
+
+## Environment
+- OS: Ubuntu 24.04.2 LTS; kernel Linux 6.8.0-147-generic x86_64
+- libc: host ldd reports glibc 2.39
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: asan (xce.build)
+- Code: feature/license-resources @ 30c51ea1-dirty (introduced by 2fcacac2)
+- Deployment: n/a (unit testsuite only)
+
+## Reproduction
+1. `src/tools/xce-build.sh controller` (asan profile) -- meson test crashes:
+   `controller - xce:controller test` FAIL with the stack-buffer-overflow above.
+- Frequency: deterministic
+- Evidence: src/testlogs.archive/xce.build/this-20261028-114408-rc1/meson-logs/testlog.txt (bug-1971 failure-preservation mechanism)
+
+## Root cause
+`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE
+resources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR
+distributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four
+caller test functions declared only
+`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 /
+4 overflowed the callers' stack arrays. When the extlic E2 tests were added to
+the builder's fixture set (2fcacac2), none of the caller declarations were
+resized. (Earlier builds of this branch compiled only a worker-focused subset
+-- `test_config_resource_reconcile` was not linked -- so the overflow went
+unnoticed until the full controller suite was built.)
+
+## Fix
+Resize all four caller arrays to match the builder: `resources[5]`,
+`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing
+contract. Files: src/controller/testsuite/test_config_resource_reconcile.c
+(test_reconcile_resources_registers_and_seeds_shared_pools,
+test_reconcile_resources_registers_new_defs_past_eexist,
+test_reconcile_resources_hot_applies_changed_definition,
+test_reconcile_resources_is_idempotent_and_hot_applies).
+
+## Verification
+- Test: whole-file suite `controller - xce:controller test` (meson): RED
+  137/137 before the fix, GREEN after.
+- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK
+  (sched push, sched worker change, apiserver push, host runusage, no-fork
+  rule, controller 91s).
+- Live: n/a (testsuite-only defect; no production code touched).
+
+## References
+- Related: none