fix: bound TypeScript semantic analysis to scan corpus

[alxxjohn]

Summary

Fixes slow TypeScript semantic analysis in large monorepos without a root tsconfig.json.

TheExample repo configuration scans the repository root and excludes node_modules, but Codeguard’s TypeScript semantic fallback previously bypassed the
shared exclusion-aware corpus. When no root tsconfig.json existed, it recursively discovered TypeScript/JavaScript files itself—including dependencies and
generated output.

This caused the semantic analyzer to consider ~26,953 JS/TS files in example repo, including ~26,505 files under node_modules, instead of the ~448 eligible project source files.

Changes

• Pass the runner’s shared, exclusion-aware corpus file list to TypeScript semantic analysis.

  • TypeScript semantic analysis now uses only Codeguard-eligible JS/TS source files.
  • The fallback no longer recursively discovers the entire target tree in normal Codeguard scans.
  • Existing direct callers without a runner context retain the prior fallback behavior.

• Deduplicate concurrent TypeScript semantic analysis.

  • Quality, design, and security sections can request the same target analysis concurrently.
  • They now share one in-flight semantic run rather than spawning duplicate Node/TypeScript processes.

• Split semantic-analysis responsibilities into focused files.

  • typescript_semantic.go: semantic execution and result handling.
  • typescript_semantic_flight.go: cache and concurrent-flight coordination.
  • typescript_semantic_sources.go: corpus-root selection and context integration.

Validation

• go test ./internal/codeguard/checks/support ./tests/checks
• go test -race ./internal/codeguard/checks/support
• Built Codeguard from this branch and ran a full self-scan.
  • Exit code: 0
  • No Codeguard finding remains for the changed TypeScript semantic analyzer files.
  • Existing repository-wide warnings remain unchanged.

Performance result

Measured against Example repo with a full, cache-warm scan:

Version Full scan time
━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━
Before ~28 seconds
───────────── ────────────────
This branch 5.24 seconds

The expected CI impact is larger on cold/constrained Buildkite workers because the previous implementation could create multiple TypeScript programs over
node_modules.

Commits

• f473e6e fix: bound TypeScript semantic analysis to scan corpus
• 3232118 refactor: split TypeScript semantic helpers