test(analyses): give the bot-filter guard one matcher and one count

[emrecdr]

A /simplify review pass over #274 (four independent angles: reuse, simplification, efficiency, altitude). Three of the four converged on the same root cause; each finding below was verified against source before acting.

One matcher, not two

Widening the guard to read whole files added collapse_offsets but left collapses_bot_per_canonical in place. Call sites confirmed: the guard calls only the former, the self-test calls only the latter.

So the anti-vacuity test — the one whose whole purpose is to prove the guard can fail — was proving a copy correct while the code that decides the gate went unexercised. Either could regress with CI green. That is the failure the module doc warns about, one layer down inside the test written to prevent it.

The self-test now runs against collapse_offsets directly, and the duplicate is gone.

Two gaps that closed with it

• The wrapped-call layout that test(analyses): scan the whole file for the bot-filter collapse #274 exists to catch had no committed test. The repro that found the bug was exploratory. It is now a fixture.
• The byte-vs-char offset fix had no test either, despite the commit message crediting a regression test for catching it — that test was never committed. There is now one, asserting the offset lands on the construct, which a char-indexed table would fail.

A double count, proven not argued

bool_or( is a substring of havingnotbool_or(, so HAVING NOT BOOL_OR(is_bot) matched both banned shapes at two different offsets and was reported twice — and the sort/dedup could not collapse them, since the offsets genuinely differ.

Rather than trust the review, the assertion was added first and run against the shipped code:

before: assertion `left == right` failed  left: 2  right: 1
after:  3 passed; 0 failed

Both rules now anchor on the same BOOL_OR token, so the dedup does what it looks like it does.

Verification

• Count assertion fails at 2 before, passes at 1 after.
• Planted wrapped call → guard fails naming ownership.rs:33: BOOL_OR(, the line the construct sits on. File restored.
• cargo fmt --all --check = 0; cargo clippy --workspace --all-targets --all-features -- -D warnings = 0 (the full CI invocation — a narrower run missed items_after_statements here); guard tests = 0.

Also

Dropped a .max(start) that cannot change its result (a push always grows the string) and hoisted a loop-invariant path strip.

Left alone: workspace_root is duplicated byte-for-byte across eleven guard tests, with the file walker and violation-reporting boilerplate close behind. Real, but pre-existing and cross-cutting — folding it in here would turn a targeted cleanup into an unrelated refactor across eight-plus files.