feat(assail): exempt Julia *Ext.jl from DynamicCodeExecution (idiomatic package-extension pattern) (#71)

## Summary

Adds a small predicate at the `analyze_julia` DCE detection site that
subtracts the Julia package-extension idiom: `*Ext.jl` files and the
conventional `ext/<Name>.jl` directory layout. These files use `eval` /
`Meta.parse` legitimately as part of the language's extension mechanism.

Mirrors the shape of #53 (JSON-LD InsecureProtocol exemption) — small
guard inline at the detector, plus regression tests for the exempt and
non-exempt cases.

## Motivation

`julia-ecosystem#6` logged 209 panic-attack findings of which ~202 were
this exact pattern. Without an exemption, every Julia repo with a single
package extension produces a flood of false positives that drowns out
real findings.

## Changes

- `src/assail/analyzer.rs` (analyze_julia): guard adds
`is_julia_package_extension` check matching `*Ext.jl` / `ext/` / `/ext/`
paths before pushing the `DynamicCodeExecution` WeakPoint.
- New tests in `#[cfg(test)] mod tests`:
- `julia_ext_jl_dce_is_exempt` — \`FooExt.jl\` with \`Meta.parse\` is
exempt
- `julia_ext_dir_dce_is_exempt` — \`ext/MyExtension.jl\` with \`eval\`
is exempt
- `julia_regular_file_still_flags_eval` — non-extension file still flags

## Test plan

- [x] \`cargo test --lib julia_\` — all 3 new tests pass locally
- [ ] CI green
- [ ] Re-scan julia-ecosystem to confirm ~202 findings drop

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/assail/analyzer.rs

@@ -4457,8 +4457,18 @@ impl Analyzer {
         weak_points: &mut Vec<WeakPoint>,
         file_path: &str,
     ) -> Result<()> {
+        // Julia package-extension pattern: *Ext.jl files use eval/Meta.parse
+        // idiomatically as part of the language's extension mechanism. Skip DCE
+        // detection for these files to avoid mass false positives.
+        let is_julia_package_extension = file_path.ends_with("Ext.jl")
+            || file_path.starts_with("ext/")
+            || file_path.contains("/ext/")
+            || file_path.contains("\\ext\\");
+
         // eval / Meta.parse (dynamic code execution)
-        if content.contains("eval(") || content.contains("Meta.parse(") {
+        if !is_julia_package_extension
+            && (content.contains("eval(") || content.contains("Meta.parse("))
+        {
             weak_points.push(WeakPoint {
                 file: None,
                 line: None,
@@ -7763,4 +7773,52 @@ pub fn safe_get_x() -> Option<String> {
             "unsafe fn / unsafe extern must not count toward the unsafe-block tally"
         );
     }
+
+    // ---------------------------------------------------------------
+    // Julia package-extension DCE exemption
+    // ---------------------------------------------------------------
+
+    fn count_julia_dce(content: &str, file_path: &str) -> usize {
+        let analyzer = Analyzer::new(std::path::Path::new(".")).expect("analyzer construction");
+        let mut stats = ProgramStatistics::default();
+        let mut wp = Vec::new();
+        analyzer
+            .analyze_julia(content, &mut stats, &mut wp, file_path)
+            .expect("analyze_julia");
+        wp.iter()
+            .filter(|w| matches!(w.category, WeakPointCategory::DynamicCodeExecution))
+            .count()
+    }
+
+    #[test]
+    fn julia_ext_jl_dce_is_exempt() {
+        let src = r#"function __init__() Meta.parse("1 + 1") end"#;
+        assert_eq!(
+            count_julia_dce(src, "FooExt.jl"),
+            0,
+            "*Ext.jl files use eval/Meta.parse idiomatically — must be exempt"
+        );
+    }
+
+    #[test]
+    fn julia_ext_dir_dce_is_exempt() {
+        // Per Julia convention some package extensions live under ext/<Name>.jl
+        // rather than the trailing-Ext.jl filename — both shapes must skip DCE.
+        let src = r#"eval(:(x = 1))"#;
+        assert_eq!(
+            count_julia_dce(src, "ext/MyExtension.jl"),
+            0,
+            "files under ext/ must be exempt"
+        );
+    }
+
+    #[test]
+    fn julia_regular_file_still_flags_eval() {
+        // Non-extension Julia files must still report eval/Meta.parse usage.
+        let src = r#"function dangerous() eval(user_input) end"#;
+        assert!(
+            count_julia_dce(src, "src/dangerous.jl") > 0,
+            "non-extension Julia files must still flag eval()"
+        );
+    }
 }