feat(rules): test-code awareness (#[cfg(test)], fixtures, CLI binaries) for built-in rules #663

Problem

The built-in rules know about tests/ and test/ directories only. Inline test code (#[cfg(test)], mod tests), fixtures and CLI binaries produce most of the noise and a share of the false Critical/Major findings. Measured with cora scan --no-llm and the cap off on uteke (Rust):

Most bug-unwrap / bug-expect hits are inside #[cfg(test)] modules; bug-println in a CLI is intentional output. On uteke-cloud, 3 Major sec-hardcoded-url findings are assert!(!url_allowed("http://gh.example")) in a unit test (the test checks that plain http is rejected), and Critical secret findings fire on test fixtures (api_key: "k".into(), "whsec_x") and e2e helper scripts.

Proposal

Add a test-context notion shared by the scanners and rules: Rust #[cfg(test)] / mod tests blocks and *_test.rs, JS/TS *.test.* / *.spec.* / __tests__, Python test_*.py / conftest.py, fixtures/, examples/. In test context skip bug-unwrap, bug-expect, bug-println, sec-hardcoded-url, and cap secret findings at Minor unless the literal has a known token prefix. Add an opt-in rules_engine.test_paths / include_tests setting. Consider skipping bug-println for binary crates (src/main.rs, src/bin/, commands/).

Done when

The measured modules above drop their #[cfg(test)]-only hits, the setting can turn test scanning back on, and real findings outside test code are unchanged (regression tests).