fix(scanner): close fs::write(dir.join ruleset bypass

[samkay-ops]

Summary

Fixes #344 — a substring check skipped any line containing fs::write(dir.join, so e.g. unsafe { ... } // fs::write(dir.join produced no finding.

Changes

• Remove the line-level skip in scan_file
• Exclude tests / test / __tests__ path segments in rust_source_files instead
• Regression test: unsafe + magic substring still yields UNSAFE_BLOCK
• Test: files under tests/ are not scanned

Acceptance criteria

• Line with unsafe and fs::write(dir.join reports UNSAFE_BLOCK
• Self-scan does not rely on the old line hack; test fixtures skipped by path

Closes #344

[N-thnI]

This branch now conflicts with main. Could you rebase onto the latest main and resolve the conflicts? Happy to merge once it's clean.

[N-i-xx]

One workflow note for future PRs: this one is raised from samkay-ops:main rather than a topic branch. Could you branch off main for each piece of work (e.g. git checkout -b fix/issue-NNN-short-description) and open the PR from that branch?

Working on your fork's main is what makes these conflict — once upstream main moves, your main has diverged and can't cleanly take the update, which is exactly what's happened here. A topic branch per issue keeps each PR independent and rebaseable, and keeps your fork's main clean to sync from upstream.

Your other PRs (#365, and the dashboard ones) already do this — just worth making it the default. Thanks!