fix: reduce precision false positives

[alxxjohn]

Summary

This PR hardens CodeGuard’s precision rules to reduce false positives in TypeScript/JavaScript-heavy application code, especially React/Next/API/
connector-style codebases.

It improves rule behavior for local builders, parser helpers, domain command functions, adapter/orchestration functions, data contracts, and
validated boundary handling so users do not need broad waivers for normal production patterns.

Changes

• Refined function.hidden-mutation, function.command-query-mix, and quality.hidden-side-effect

  • Allows local Map/Set/array/object accumulation in builder/parser/collector functions.
  • Preserves findings for actual parameter, collaborator, module/global, or external state mutation.
  • Allows domain side-effect names such as loadAbuseConfig, evaluateActionAbuse, and maybeAlert.

• Reduced noisy duplicated-knowledge findings

  • Ignores CSS/style literals, sentinel values, enum/status-like literals, and table/config value strings where centralizing would add noise.
  • Keeps stronger business-domain literal detection intact.

• Improved naming precision

  • Allows valid predicate/conventional names such as areStickerPlacementsEqual, asRecord, cached, keys, thresholds, and source.
  • Reduces value noise when local context makes the role clear.

• Improved design/smell precision

  • Allows DTO mappers, serializers, CSV/export helpers, prompt builders, adapters, and CRUD/orchestration functions.
  • Allows packages/api/src as a persistence boundary.
  • Ignores persistence vocabulary in comments, tests, fixtures, mocks, and stubs.
  • Reduces smell.message-chain and smell.feature-envy noise for normal traversal/mapping code.

• Improved defensive-pattern recognition

  • Recognizes helper-based validation and zod safeParse.
  • Recognizes new URL(...) with protocol allowlist checks.
  • Recognizes Content-Length preflight before formData().
  • Recognizes byte-length checks after bounded response reads.
  • Treats P2002 retry loops for unique external ID allocation as guarded sequence-collision handling, not integer overflow.

• Improved TypeScript semantic design checks

  • Skips large data-contract and React prop interfaces for design.typescript.max-interface-members.
  • Keeps true large behavior/policy interfaces eligible for findings.

Validation

• go test ./tests/checks -count=1
• go test ./...
• golangci-lint run
• make codeguard-ci