[SizzleUnrlsd]

Summary

hardcoded-credential and config-secrets classified the absolute path. A project under a directory named test, tests, testing, fixtures or __tests__ had every credential at low confidence, as test code. Its template files were labelled test instead of example.

As proposed in #253 (first direction), the rule keeps the decision and is given the file's path in the project:

• findings.context.path_in_project is the single rule for "the path from the root". The engine uses it for the context of findings: test code is recognised only by hardcoded-credential #244, and so do the plugins.
• PluginContext.path(source_id) gives that path to module plugins; run_plugins takes an optional root. This is an additive API change: callers without a root keep their behaviour.
• The engine passes the root on every path: one process, worker processes (from their project configuration), and a file checked alone (the same reference as the context: the file's directory).
• SecretDetector.judge takes the path in the project. hardcoded-credential reads it from ctx.path, and config-secrets computes it from ctx.root. credential_context is unchanged.

Verdicts change only for projects located under such a directory: that is the fix.

Verification

• tests/test_credential_project_path.py, new: 5 tests, 3 of which fail on main. They cover:

  • the reproduction of hardcoded-credential: test code is judged on the absolute path, so a project under a tests directory has every credential at low confidence #253 for both rules, with -j 1 and -j 2;
  • the project's own tests and .env.example, which keep the lower confidence;
  • a file checked alone;
  • a source that is no file.

  No existing test changed.

• Full suite green, apart from the local test_packaging metadata issue. ruff check and mypy clean. Regression snapshots unchanged.

Closes #253