Implement proof and refutation passes #32

Post-detection evidence engine.

• Numeric range analysis (feat: refutation evidence #45: abstract.ranges interval domain with branch refinement and widening; a numeric value cannot inject, ranges appear in the evidence)
• String constraints: isdigit() / isalnum() / ... guards, constant allowlists, equality with a constant (feat: proof and refutation engine #33)
• Path constraints along source-to-sink paths: branch truths fixed by which side alone reaches the sink, combined through not / and / or (feat: proof and refutation engine #33)
• Dominant guards using dominators (feat: proof and refutation engine #33)
• Sanitizer evidence (taint engine, feat: security models and global taint engine #20), constant-propagation evidence for unreachable sinks (feat: proof and refutation engine #33), authorization guards (feat: refutation evidence #45: AuthorizationGuard model on decorators and dominating conditions, flows behind one are hotspots)
• Verdicts Vulnerability / Hotspot / Refuted consumed by detectors (feat: proof and refutation engine #33); plugins add evidence through Validator and AuthorizationGuard models in Plugin.models (feat: refutation evidence #45), which realises the RefutationPlugin type without exposing the IR

Reference: docs/architecture.md §24 Proof / Refutation Engine, §25 plugins/proof.

Delivery: #33 (refutation engine)
Delivery: #45 (ranges, validators, authorization guards)