53 analyzer expand security coverage enforce global strict test runner stabilize expectation matching

[SizzleUnrlsd]

Summary

This PR consolidates a broad analyzer + test infrastructure effort:

• expanded security analysis coverage,
• hardened run_test.py with global strict validation,
• fixed expectation matching regressions (both too brittle and too permissive cases),
• added/fixed/reorganized security fixtures.

Main changes

1) Analyzer / pipeline

• Added and integrated multiple security analyses (including null deref, integer overflow, TOCTOU, command injection, OOB read, type confusion).
• Updated core components:
  • src/analyzer/AnalysisPipeline.cpp
  • src/analyzer/DiagnosticEmitter.cpp
  • src/app/AnalyzerApp.cpp
  • src/analysis/*
  • include/analysis/*
• Updated models:
  • models/resource-lifetime/generic.txt
  • models/buffer-overflow/generic.txt

2) Test runner (run_test.py)

• Enabled strict warning/error count as a global policy for fixtures.
• Enforced strict validation even when expectations are partial.
• Improved matching for combined diagnostics within the same location block.
• Fixed location tolerance behavior:
  • resilient to realistic line drift,
  • rejects obviously stale/far-off line anchors.
• Relaxed brittle inter-TU checks that depended on exact line-number strings.

3) Test corpus

• Backfilled missing expectations in many fixtures.
• Added advanced regression cases (nested control flow, inter-TU, tricky paths).
• Reorganized security fixtures into:
  • test/security/<vulnerability-category>/...
• Kept legacy compatibility through test/files shim documentation/Makefile.

Validation

• Command:
  • python3 run_test.py --jobs=8
• Result:
  • 821/821 passed

Behavior changes

• Strict count is now a central quality gate:
  • tests fail when warning/error comments do not match analyzer output count.
• Stale line anchors are no longer silently accepted by over-tolerant matching.

Exclusions for this PR

Please explicitly exclude:

• tmp/
• .cache/
• local artifacts (.DS_Store, __pycache__, local analysis outputs)

Checklist

• Analyzer integrated and buildable
• Strict runner behavior stabilized
• Regression suite green
• Security corpus reorganized
• Local artifacts excluded