fix(neutrality): span-based allow-phrase exemption (from PR #3)

[StevenMih]

Summary

• The `allow_phrases` exemption in `neutrality_scan.py` was over-exempting: any occurrence of a reserved token on a line was exempt if ANY allow-phrase carrying that token also appeared on the same line.
• Fix: track allow-phrase character spans `[start, end)` over the lowercased line; a vocabulary hit is exempt ONLY when its span falls inside an allow-phrase span.
• Two occurrences of the same token on one line are now handled correctly: the one inside the phrase is exempt, the one outside is flagged.

Changes

• `neutrality_scan.py`: span-based `_line_offenders`, new `_git_tracked_files` helper (scan only git-tracked files), `_run_self_tests` / `--self-test` flag with 3-case test, `.html` added to SCAN_SUFFIXES
• `neutrality.yml`: adds "Neutrality scanner self-test" step before the vocabulary scan

Test plan

• `python .github/neutrality_scan.py --self-test` → `neutrality self-test: OK (span-based allow-phrase exemption)` (all 3 test cases pass)
• CI neutrality job passes on merge

Propagated from scitt-payload-binding PR #3 Fix 4.

🤖 Generated with Claude Code