fix(resolve): gate the exact byQualified path; never bind production code to test symbols

[luuuc]

Problem

Follow-up to #116. After that fix, a real Rails codebase still showed 603 production→test structural edges (465 calls + 138 references) where production code resolved a call/reference to a symbol defined in a test file. Root cause: the resolver's gates (cross-language, receiver, cross-scope demotion) only ran on the fallback path. Targets that hit byQualified exactly skipped every gate, so:

• a bare Ruby call like x.count (emitted at ConfidenceUnresolved, receiver unknown) exact-matched a same-named JavaScript constant in a test spec and resolved at 0.5;
• a constant call like I18n.t exact-matched a JS test-helper I18n.t at 1.0.

598 of the 603 were cross-language (Ruby production → JS test specs); the other 5 were same-language (a helper's url_for binding to FiltersHelperTest#url_for, where the real method is framework-inherited and unindexed).

Summary

Extend the gates the fallback already applies to the exact byQualified path, and add a one-directional production→test gate.

Changes

• Exact-path cross-language gate — calls/tests/references exact matches now run through filterByLanguage, exempting intentional synthetic cross-language targets (partial:, turbo-*, importmap:, i18n:, route:, ruby-core:). When the exact name matches only gated-away coincidences, the edge drops to unresolved instead of leaf-falling-back into another coincidence.
• Bare-guess routing — a bare target emitted at ConfidenceUnresolved (receiver unknown) skips the exact shortcut and goes through the gated fallback, which demotes it below blast's floor rather than letting a leaf coincidence resolve at 0.5.
• filterByTestDirection — a production-source calls/references edge cannot resolve into a test file. Test files define stubs/helpers that shadow real (often framework) names, so a same-named match there is a coincidence. One-directional: test code still references both production and test symbols.
• SymbolRef.Path — carried through the existing SymbolRefs left-join so the resolver can determine per-file test-ness, mirroring how it already carries Language.

Architecture / scope notes

• isTestPath is a small local copy of mcpio.IsTestPath. resolve is a low-level package and must not depend on the presentation layer, so the copy is deliberate; hoisting a shared predicate into a base package is a reasonable follow-up, intentionally out of scope here.
• Temporal production↔test co-change coupling is legitimate and left untouched — the gates apply only to structural calls/tests/references edges.

Verification (real Rails app)

• production→test calls+references edges ≥0.5: 603 → 0
• cross-language structural edges: 803 → 0
• legit edges intact: production→production calls 6,773, test→production edges 6,083, temporal coupling preserved

Test Plan

• Resolver: cross-language exact-drop, synthetic-target exemption, production→test (exact + fallback), test-source exemption, bare-guess routing (demote + drop)
• White-box: isTestPath, isSyntheticTarget, filterByTestDirection; adapter carries Path
• Coverage ≥92% line & per-function on modified files (resolver.go 98.7%, all new functions 100%)
• make ci fully green (build, test, lint 0 issues)
• sense binary builds cleanly

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!