v0.1.10 — a string bound to a name is documentation too

Reported by tool-boundary-corpus, a labelled corpus that measures this detector's precision.

The false positive. Case code-pattern-only-in-comments is a file where the vulnerable pattern appears only inside a module constant:

DOCSTRING = """
    if tool.name in self.tools_dict:
        logger.warning("duplicate")
    self.tools_dict[tool.name] = tool
"""

The scanner reported tool-dict-last-wins at the line inside that string. Untaken string content is no more executable than a comment. Precision on the corpus was 0.750; every other case passed.

The fix. masking.py already treated a bare string statement (a docstring) as prose, and deliberately kept string arguments visible because tool-dict-last-wins reads the logging message as evidence. A string assigned to a name fell between the two. The prose classifier now also covers a string that is the entire right-hand side of an assignment. Strings inside a literal stay visible — that is what the reserved-set rules read — and a logging message is still an argument and still evidence.

Measured after the change

check	before	after
precision on tool-boundary-corpus	0.750	1.000
recall on tool-boundary-corpus	1.000	1.000
agentbound scan agentbound (the CI contract)	exit 0	exit 0
repository-root scan (fixtures on purpose)	25 findings	16
tests	114	114 (3 added)