* fix(taint): refine values after accepted guards
Preserve bounded value restrictions through local flows and function
summaries. Check the complete command against the modeled sink use
before suppressing a finding. Unknown paths and exhausted budgets
retain conservative findings.
Refs #3490
* fix(taint): preserve guard proof identities
Reject destructured/rest formals before they inherit a whole-argument
proof, and include transitive alias uses in bounded guard certificates.
Add worker regressions, argument-heavy scaling coverage and global
refinement fallback diagnostics.
Refs #3703
* perf(cfg): reuse scope and argument facts
Reduce duplicate native AST reads and allocation in TypeScript CFG collection
while preserving argument forwarding and malformed-input recovery.
Add regression cases and a portable paired benchmark with recorded results.
* test(cfg): distinguish validator cases
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
