verify-action-build: skip binary-download check for pure data fetches

[potiuk]

Summary

The binary-download check currently flags every tc.downloadTool / fetch / https.get in JS source that doesn't sit alongside a hash/signature pattern. That over-flags actions that fetch HTTP responses as data — a metadata badge regex'd for an integer, an API JSON parsed for a version number — where there is no binary or executable to verify in the first place.

Add a per-file heuristic that exempts pure data fetches from the check.

The false-positive that motivated this

PR #752 (dependabot/fetch-metadata 3.0.0 → 3.1.0) was flagged on src/dependabot/verified_commits.ts:99:

const svg = await new Promise<string>((resolve) => {
  https.get(`https://dependabot-badges.githubapp.com/badges/compatibility_score?...`, res => { ... })
})
const scoreChunk = svg.match(/<title>compatibility: (?<score>\d+)%<\/title>/m)
return scoreChunk?.groups ? parseInt(scoreChunk.groups.score) : 0

This is a computed-on-demand SVG badge — no possible "expected hash" exists, and a regex-extracted integer doesn't cross a security boundary. Adding a checksum upstream would be cargo-cult.

The heuristic

A file's download calls are exempted iff both hold:

1. The file contains at least one data-parse marker: .match / .matchAll / .replace / .test / .split / .includes / .startsWith / .endsWith / .toLowerCase() / .toUpperCase() / JSON.parse / parseInt / parseFloat / Number(...).
2. The file contains no binary-handling markers: tc.extractTar / tc.extractZip / tc.extract7z / tc.extractXar, tc.cacheFile / tc.cacheDir, fs.writeFile family, exec.exec / child_process / spawn, chmod calls, 'chmod +x' strings.

Per-file scope (not per-finding): a file that mixes a metadata fetch with a real archive download keeps the strict check on every download in it. Per-finding scoping would need a real AST to track which response gets passed to which use, and the conservative blanket rule is preferable to a flaky one.

Verified behaviour

Action	Before	After
dependabot/fetch-metadata@v3.1.0 (the false positive)	✗ 1 unverified JS download	✓ no downloads or all verified
leafo/gh-actions-luarocks@v6.1.0 (real tc.downloadTool + tc.extractTar)	✗ 1 unverified JS download	✗ 1 unverified JS download (still flagged — correct)

Test plan

• 7 new unit tests in test_security.py::TestPureDataFetchExemption covering: pure-data-fetch exempted, real-binary still flagged, mixed-file not exempt, no-data-parse-marker not exempt, chmod +x string disables exemption, JSON.parse alone exempts, .split alone exempts.
• Full suite: 146 tests pass.
• Live smoke against dependabot/fetch-metadata@25dd0e34 — Binary download verification: ✓ (was ✗).
• Live smoke against leafo/gh-actions-luarocks@35d062de — still ✗ (the real flag we want).

Generated-by: Claude Opus 4.7 (1M context)