fix(scanner): Resolve imports conservatively

[reneleonhardt]

What does this PR do?

Limit fuzzy resolution to compatible language families. Resolve Go imports only to indexed, non-test files in the current module; keep bare JS/TS packages external unless a configured alias proves an included local target.

Type of change

• Bug fix
• New feature
• New language support
• Documentation
• Other

Verification

• go test ./scanner -run '^(TestBuildFileGraphImportResolutionBoundaries|TestFilteredImportResolutionTargets)$' -count=1
• go test ./scanner -count=1

Developed with carefully directed, manually reviewed AI assistance.

Co-Authored-By: GPT-5.6 Sol codex@openai.com

[JordanCoin]

Heads up: #84 just landed on main and overlaps this PR in scanner/filegraph.go (it added a blunt fail-closed gate for non-local Go imports — same bug you're fixing here, discovered independently the same day).

I test-merged main into this branch locally to scope the damage — it's small:

• One conflict hunk, the Go package index condition: your _test.go exclusion + main's slash-normalized keys (Windows fix) compose cleanly into one line.
• After the merge-up, main's if strings.HasSuffix(fromFile, ".go") { return nil } fallthrough gate sits below your Strategy-1 fail-closed Go path and becomes dead code — your language-family design subsumes it, so I'd say delete the blunt gate in favor of yours.
• Main also gained scanner/filegraph_truth_test.go (stdlib-collision, no-module, and non-Go regression tests). Those should stay green as the contract on top of your changes — they looked compatible in my local merge.

Your call on mechanics: happy to push the merge-up to this branch (maintainer edits are enabled), or leave the rebase to you if you'd rather keep authorship of the reconciliation. Either way this is close — nice conservative design.

[reneleonhardt]

Rebased onto current main and incorporated all three points:

• the Go index now combines the _test.go exclusion with slash-normalized package keys
• the superseded .go fallthrough was removed in favor of the Strategy-1 fail-closed path
• and the new truth tests remain green.

This is reconciliation with PR84 only — this PR's conservative-resolution scope and behavior are unchanged.