test(analyses): scan the whole file for the bot-filter collapse

[emrecdr]

Validating the cycle-13 audit confirmed its new finding, and fixing it reproduced the same defect one level down.

F307 — the matcher read one line at a time

F305 taught this guard that SQL is case-insensitive and whitespace-tolerant, then normalised each line independently. A call wrapped across lines is never assembled, so its argument is never seen.

Confirmed by planting BOOL_OR( with a.is_bot on the next line inside a SQL string literal — the guard passed.

Not a hypothetical layout. analyses/ownership.rs already writes SUM( with its argument and closing paren on their own lines, in the very directory this scans. A BOOL_OR( whose argument grew that long would be written the same way by the same convention.

Fix: normalise the file once, map matches back to a file line by counting newlines in the prefix — the technique spa_escaping_test already uses.

The bug inside the fix, recorded because it is the same class

My first mapping indexed its offset table per character while match_indices returns byte offsets. On any file containing a multi-byte char — and these contain them in their prose — the table drifts. The guard detected the right thing and named the wrong line:

before:  soc.rs:142: _bot
after:   soc.rs:141: BOOL_OR(

Caught only because the regression test read the reported location, not just pass/fail. A guard that names the wrong line is one people stop trusting.

Verification

case	result
wrapped SQL, qualified column	previously passed → now fails, naming the construct's line
all four single-line spellings	still caught
clean tree	still clean

Also: the Trusted Publishing deferral's reason was wrong

I deferred it claiming cargo publish executes build.rs and so cannot hold id-token under SLSA L3. Only the verification step builds, and --no-verify switches it off. Reproduced independently on cargo 1.97.1 (the audit used 1.95.0), with a control:

command	build.rs executed
cargo package --no-verify	no
cargo package	yes

The architecture is compatible. The deferral stands on sequencing instead: Trusted Publishing must be configured per-crate on crates.io — outside this repository — and switching the workflow before that exists breaks the next release. Recorded so the next cycle doesn't re-derive a resolved argument.

clippy and fmt verified by exit status.