fix(phi-scan): widen the walk to src, test and scripts

[NSchatz]

What

The all-mode walk of scripts/phi-scan.ts was rooted at test/__fixtures__ and src only, so 89
of this repository's 123 tracked files were scanned by NEITHER of the scanner's two routes. It now
roots at src, test and scripts, opening 72 tracked files instead of 34.

This is PHI-SCAN-WALK-ROOT-SCOPE, the other half of the item #38/#39 closed: the observation
rule made the gate refuse a root it never opened, and this moves the roots so they cover the files
that actually exist.

The measurement, re-derived on ba059a2 rather than ported

123 tracked files; 34 opened by the walk (7 test/__fixtures__ + 27 src/); 89 in neither
route; 7 of those carrying an inline HL7 PID| literal.

RED before, GREEN after, back to back on that sha. A dashed SSN and an off-domain address written
into test/planted.test.ts, in this repository's own inline-message shape (a whole HL7 message as one
.ts string literal with \r escapes between its segments), exited 0 with OK, no hits in all
mode, while phi-scan test/planted.test.ts reported both at exit 1 over the same bytes. A file
written under scripts/ behaved identically. Both routes now report both. 14 of the suite's 68
cases red against ba059a2's scanner.

All 38 newly opened files were hand-read. Every message literal is a placeholder (DOE^JANE,
X^^^H^MR, SENDER, ZZSENTINEL*) and the only SSN/email shapes anywhere are the scanner's own
declared synthetic payload. So the 89 were an ENUMERATION gap, not a live PHI exposure - the
defect is that the gate could not see those files, so nothing would have caught a real value.

The roots

test replaces test/__fixtures__ rather than joining it. Roots must stay disjoint: each is
walked independently and the results concatenated, so a nested root would enumerate every file
beneath it twice and report each hit twice. The fixture directory is still watched, through the
observation rule's other condition; only the root a refusal is filed under moved, which is what four
updated assertions are.

scripts is in because the allow-list, the override log and the scanner itself live there, so the one
directory guaranteed to hold PHI-shaped text was the one nothing enumerated. All nine files were
measured against the detector before the root was declared: zero hits. Deliberately not roots,
each measured: vendor/ (DEFLATE streams), docs-content / documentation / .changeset (every
tracked file is .md, which the walk skips), .github and the repository root.

A narrowing came with it: test/__fixtures__ is no longer a root, so a live or dangling symbolic
link at that path is now an enumerated entry and is refused outright, whatever it points at. Only
the three top-level roots are still followable.

The one exempt path

test/scripts/phi-scan.test.ts carries violator literals on purpose, as the positive half of the
scanner's own tests. Three properties, each with a control that reds when it is removed:

• applied at the scan, never the enumeration - still read, still observed, still reconciled, and
  an unreadable one still exits 2 rather than passing as exempt;
• scoped to the all-mode sweep - naming the file still reports every hit, because an unscoped
  exemption would DELETE a detection the base had;
• per path, never a pattern.

Allow-listing the values instead was refused: EMAILDOMAIN is global, and the dashed-SSN check
consults no allow-list at all.

What this bought, and what it did not

It bought the SSN/email floor over 38 more files and nothing else. Structured, field-level
detection is still the unimplemented TODO in scanTarget, and a test pins what is still missed (an
undashed nine-digit id, a name, a DOB and an address in the same PID segment, all at exit 0).

The recogniser was NOT widened, on measurement. The companion defect this class carries is that a
recogniser assumes the file IS the document, so enumerating a .ts source whose message is an
inline literal buys nothing. That needs an anchored detector, and this scanner has none:
scanCommonShapes is two unanchored passes over the whole text. Pinned by an anchor-free probe that
puts one token in three placements and requires all three to red. The one widening a sibling shipped
here, an escape-decoded second view, finds nothing the raw view does not over the whole
newly-opened corpus, so it ships as a tripwire with a negative control rather than as a guard with
no measurement behind it: if a source ever hides a token behind an escape, the suite reds and says to
widen in addition to the raw pass.

Out of scope, stated rather than implied

• --staged is unchanged. Widening it changes what a commit is BLOCKED on, which is a hook
  decision. The two routes therefore differ widely and the module header says by how much.
• The path-SET escape is unchanged and still disclosed on four surfaces: the reconciliation
  compares path sets, not the bytes git carries at those paths, so a root swapped for a directory
  mirroring the tracked names still exits 0 over decoy contents. The widening does not make it
  worse; it only moves which paths a decoy has to mirror.
• Both named PRE-EXISTING minors were re-measured NOT open here.
• .github/workflows/ci.yml's banner says the ruleset requires four contexts while it requires
  seven. Flagged, not fixed: it is its own item.

Verify

verify.sh cli: 12 steps ran, 10 green, 424 tests, 97.7% statements. The two failures are
pnpm audit --prod --audit-level high and the licenses gate
(ERR_PNPM_MISSING_PACKAGE_INDEX_FILE for the vendored @cosyte/fhir tarball). Both reproduce
byte-identically on a base tree restored by file copy, package.json and pnpm-lock.yaml are
untouched by this branch, and no CI job runs either command. The licenses one is newly visible
rather than newly broken: the umbrella's ladder used to print green on that step without running it.