fix: reduce defensive precision false positives

[alxxjohn]

Summary

• narrow defensive.bounds-assumption so object/dictionary keys and Promise.all tuple destructuring are not treated as unchecked sequence indexing
• narrow defensive.missing-resource-limit so upload/config names do not count as boundary reads, while raw body reads still do
• skip UI/React helper contexts for defensive null-assumption and unvalidated-boundary-input checks

Tests

• env -u GOROOT GOCACHE=/private/tmp/codeguard-go-cache go test ./tests/checks

Knowledge Captured

• .claude/knowledge/testing-patterns.md: defensive positive fixtures should avoid UI-ish render* names unless intentionally testing UI suppression.