[SizzleUnrlsd]

Stacked on the dynamic-import PR, which only shares an adjacent line of docs/usage.md. Merge after it.

Summary

• One classification of test code in findings/context.py:
  • is_test_code: whether a path is test code;
  • code_context: the context a finding carries.
• hardcoded-credential uses is_test_code, so its behaviour is unchanged.
• The engine adds context: test to every finding in test code, judged on its path relative to the project root, before refiner plugins run, so that they can read it. A context a rule gives (example) stays.
• The context changes no verdict. It is exported in the JSON report and as a SARIF result property, next to injection.

Verification

• tests/test_code_context.py, new: 16 tests, covering:

  • the classification;
  • the context on every finding, with unchanged verdicts compared with the same code outside the tests;
  • a project located under a directory named tests;
  • SARIF;
  • a refiner that reads the context.

  No existing test changed.

• Full suite green, apart from the local test_packaging metadata issue. ruff check and mypy clean. Regression snapshots unchanged.

Known, not changed here: hardcoded-credential classifies the absolute path, so a project located under a directory named tests gets all its credentials at low confidence. Fixing that needs the project root in the plugin API and changes verdicts; it belongs to its own issue.

Closes #244