fix: retune precision false positives

[alxxjohn]

Summary

This PR retunes CodeGuard's local quality precision checks to reduce high-volume false positives from common TypeScript/JavaScript, React, Next.js, and API-boundary patterns while preserving the intended production-readiness signals.

What changed

• Hardened function.hidden-mutation so local scratch mutation in pure builders/parsers is not treated as hidden mutation.

  • Allows local Set.add, Map.set, array.push, .sort, .split().pop(), object accumulation, and Cheerio cleanup when the function returns a derived value.
  • Keeps the rule focused on mutation of arguments, module/global state, collaborators, React state, DOM, DB, filesystem, or other external resources.

• Retuned function.command-query-mix for query-safe builder/parser patterns.

  • Pure builders/parsers that mutate local scratch state no longer look like command/query violations.
  • Command functions that intentionally write and return useful results are treated as normal API/application behavior.

• Improved boundary/resource validation recognition.

  • Credits z.safeParse, helper-returned validated values, NextResponse early-return guards, new URL(...) plus protocol allowlists, shared upload validators, and imported byte-limit constants.
  • Credits Content-Length preflight, explicit take/limit, slice, count/size/byte guards, and bounded response byte-length checks for defensive.missing-resource-limit.

• Split sequence-allocation risk from arithmetic overflow.

  • Added defensive.sequence-collision-risk for count-derived external ID allocation without guarded unique-collision retry.
  • Keeps guarded Prisma/P2002 retry loops out of defensive.integer-overflow.
  • Suppresses metric/stat arithmetic from overflow findings.

• Reduced naming and smell noise.

  • Allows common UI boolean/domain names such as show*, matches*, visible, active, open, selected, enabled.
  • Allows collection/domain abbreviations such as krs, docs, and ids.
  • Tolerates centralized enum/domain dispatch maps for smell.switch-on-type.

• Added rule metadata and documentation.

  • Registered defensive.sequence-collision-risk in the rule catalog and fix-template catalog.
  • Updated docs/checks.md so users can discover the new defensive rule.

Tests

• Added regression coverage for local builder/parser mutation patterns.
• Added regression coverage for boundary validation and resource-limit proof patterns.
• Added regression coverage for sequence-collision vs integer-overflow behavior.
• Updated existing UI false-positive hardening tests to match the narrower analyzer behavior.

Validation

• go test ./tests/checks -run 'TestDefensive(Integer|Resource)|TestRulesCatalog' -count=1
• go test ./tests/checks -count=1
• go test ./...
• golangci-lint run
• make codeguard-ci