Fix static rule substring false positives

[RNA4219]

What changed

• Bind hardcoded-secret variable detection to the assigned variable name instead of unrelated words elsewhere on the line.
• Prevent the deprecated Buffer() rule from matching arrayBuffer().
• Add regression tests for the Lakda fixture/action ID and screenshot CSS cases.

Why

A real Code-to-gate scan of domain-lakda-runner produced two High false positives and one Medium false positive. The findings came from substring matching rather than the actual assignment/API token.

Validation

• npx vitest run src/rules/__tests__/hardcoded-secret.test.ts src/rules/__tests__/deprecated-api.test.ts (25 passed)
• npm run lint
• npm run test:smoke (56 passed)
• Re-analyzed domain-lakda-runner: Critical 0, High 0; findings reduced from 8 to 5 reviewed Medium items.

[github-actions]

code-to-gate PR Review

Gate Verdict

• Status: needs_review
• Readiness: passed
• Findings: 9 total, 3 critical, 1 high

Blocking Reasons

• No blocking reason was found.

Acceptable Risks

• [info] Readiness verdict is passed: All policy conditions met, release ready
• [info] No unsupported claims are present: LLM or imported claims that lack evidence are not present in findings.unsupported_claims.
• [info] Public docs, CLI, schema, and schema coverage are aligned: 8 spec drift checks passed without failures.

Suggested Tests

• [high] Run src/rules/tests/deprecated-api.test.ts: Test path matched changed source path. Command: npm test -- src/rules/tests/deprecated-api.test.ts Source: test-plan-001, src/rules/tests/deprecated-api.test.ts, src/rules/deprecated-api.ts
• [high] Run src/rules/tests/hardcoded-secret.test.ts: Test path matched changed source path. Command: npm test -- src/rules/tests/hardcoded-secret.test.ts Source: test-plan-002, src/rules/tests/hardcoded-secret.test.ts, src/rules/hardcoded-secret.ts
• [high] Define expected behavior for scripts/package-smoke.mjs and add a focused regression or manual black-box check.: No related automated test was found for this changed source file. Source: oracle-gap-001, scripts/package-smoke.mjs

Spec Drift

• No spec drift was found or no spec-drift artifact was provided.

Drift Budget

• No drift budget summary is available.

Evidence Links

• Release readiness: .qh/release-readiness.json schema: release-readiness@v1 hash: 8f1ead1ebedca072
• Findings: .qh/findings.json schema: findings@v1 hash: 76f212d4300d83fd
• Auto test plan: .qh/test-plan.json schema: test-plan@v1 hash: 86e81198a5790754
• Spec drift: .qh/spec-drift.json schema: spec-drift@v1 hash: 55f1e2de1f60cca9
• Evidence DAG: .qh/evidence-dag.json schema: evidence-dag@v1 hash: 4ad49533ce83a058
• QEG evidence input: .qh/qeg-code-to-gate.json schema: ctg.qeg-input/v1 hash: 4e8d5ad59c4c8af0
• Published quality report: https://github.com/RNA4219/code-to-gate/actions/runs/29335300545

Suppression / Baseline Summary

• No baseline summary is available.

Gate Explainability

• No gate explainability summary is available.

---

Generated by code-to-gate v1.5.0