iac-codemod AssertDiffSetsNeedsReplaceForForceNew false-positive on accumulator pattern

[intel352]

Context

Surfaced during P-DO migration (workflow-plugin-digitalocean PR #61): the AST analyzer AssertDiffSetsNeedsReplaceForForceNew flagged VolumeDriver.Diff as a contract violation. The driver actually DOES correctly assign NeedsReplace from a local needsReplace accumulator at line 232 — the analyzer's pattern-matching missed the indirect assignment.

Requested

Tighten the analyzer to recognize the local-accumulator pattern (needsReplace := false; ... needsReplace = true; ... result.NeedsReplace = needsReplace).

Reference

• workflow PR feat(codemod): cmd/iac-codemod with 4 modes + workspace migration target (W-8 of 12) #538 (W-8 codemod)
• workflow-plugin-digitalocean PR Global rate limiter state in module/api_gateway.go breaks plugin isolation #61 (P-DO surfacing)