Reduce false positives in the risky-code token-term recipe

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for risky-code token-term false positives LSP parser token auth token.

Evidence:

• The risky-code recipe includes a token-term child query.
• In this codebase, token often refers to lexical tokens, parser tokens, LSP tokens, or cancellation tokens rather than authentication tokens.

Problem:
The recipe is useful for security audit discovery, but the token term can drown out auth/security-relevant findings.

Acceptance criteria:

• Narrow the token-term query toward auth/credential/token-secret contexts.
• Exclude or down-rank syntax/parser/LSP/cancellation-token domains by default.
• Keep an escape hatch for broad token searches when requested.

[Widthdom]

Work started on branch fix-issue3787-3714-3731-3710-3694-3693-3670-3696.