Fix null-pointer dereference in CAFMaker truth matching + leak and copies

[gavinsdavies]

Part of #303.

Fixes

Null-pointer dereference in truth matching (VertexFiller.cxx, two occurrences). The truth-match fallback tries id, id+1, id-1 in ssdHitMap; when all three lookups fail it sets isOk = false, but the next line unconditionally evaluated abs(ssdHitMap[id]->PId()). On a missing key, std::map::operator[] inserts a null sim::SSDHit* which is immediately dereferenced — UB/crash whenever a track line segment has no nearby truth hit. Fixed with a short-circuit guard (isOk && ...); the id-fallback semantics are unchanged (when a lookup succeeds, id is left at the found key exactly as before).

File-name buffer leak (CAFMaker_module.cc::respondToOpenInputFile). new char[] + strcpy + basename(), never freed. Replaced with std::string-only basename logic; no raw buffer.

Per-event product vector copies (VertexFiller.cxx, ClusterFiller.cxx). Full copies of the vertex/SSD-hit/cluster product vectors per event replaced with const references (empty-vector fallback preserved). trks and arichids are deliberately left as copies: GetBeamTrack/GetSecondaryTrack take non-const rb::Track&/rb::ArichID&, so const-ref elements cannot bind — noted in a comment; changing those signatures is out of scope here.

Verification

Behavior-preserving by construction except the dereference guard, whose before/after is described above (before: UB; after: the electron check is skipped only when no hit was found, in which case isOk already excluded the truth record). Downstream read-only use of the converted containers was checked. No local art/UPS build environment and no repo CI — a collaborator build before undrafting would be appreciated.

🤖 Assisted by Claude Code (claude-fable-5)

[FNALbuild]

✔️ CI build for EMPHATIC Succeeded on slf7 for maxopt -- details available through the CI dashboard