fix(assail): tighten UnboundedAllocation Rust heuristic (72→6 on 007)

- Scan code_only (comments + string literals already stripped) instead of
  raw content, same fix shape as 6f18caf for UnsafeCode. Dangerous-word
  keywords (unbounded / infinite / unlimited / …) no longer trigger on
  comment text, doc-strings, or source embedded in raw string literals.
- Remove the bare `for ` + `push(`, `while let` + `push(`,
  `loop` + `push/Vec::new`, and `recursion` pair heuristics. These
  substrings co-occur in virtually every non-trivial Rust file (normal
  bounded iteration is `for x in collection { v.push(y) }`), so they
  produced ~60 Critical findings per average repo at near-zero signal.
- Add `is_infinite` exclusion so Rust std `f64::is_infinite()` no longer
  counts as an `infinite` keyword hit.

Measured impact on 007-lang:
- Before: 72 UnboundedAllocation Critical findings (72 distinct files).
- After:   6 residual findings, all either accepted full-file reads of
           trusted source/config inputs (`std::fs::read_to_string` in
           CLI/import-resolver/diagnostics paths) or benign test-fn
           identifiers inside `#[cfg(test)] mod tests` blocks that the
           file-path-based test suppressor does not yet reach
           (`choreography_unbounded_loop`, `validate_detects_left_recursion`).

All 167 lib tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/assail/analyzer.rs

@@ -836,26 +836,37 @@ impl Analyzer {
         // Count allocations but flag unbounded patterns separately
         stats.allocation_sites += vec_new_count + box_new_count + string_new_count;
 
-        // Flag unbounded allocation patterns as high-risk - Enhanced detection
-        let has_unbounded_allocations = content.contains("while let") && content.contains("push(") ||
-                                      content.contains("for") && content.contains("push(") ||
-                                      content.contains("unbounded") ||
-                                      content.contains("no_bound") ||
-                                      content.contains("no_limit") ||
-                                      content.contains("infinite") ||
-                                      content.contains("boundless") ||
-                                      content.contains("unlimited") ||
-                                      content.contains("unconstrained") ||
-                                      // Common unbounded loop + allocation patterns
-                                      (content.contains("loop") && content.contains("Vec::new")) ||
-                                      (content.contains("loop") && content.contains("push")) ||
-                                      (content.contains("recursion") && !content.contains("depth")) ||
-                                      // Suspicious capacity patterns
-                                      content.contains("with_capacity(0)") ||
-                                      content.contains("with_capacity(1)") ||
-                                      // Network-related unbounded patterns
-                                      (content.contains("read_to_end") && !content.contains("limit")) ||
-                                      (content.contains("read_to_string") && !content.contains("limit"));
+        // Flag unbounded allocation patterns as high-risk.
+        //
+        // The check runs against `code_only` (comments + string literals already
+        // stripped) so that dangerous-word keywords embedded in doc comments,
+        // string literals, or generated source text do not falsely fire.
+        //
+        // The earlier version also paired bare `for` / `while let` / `loop`
+        // tokens with `push(` or `Vec::new` as standalone heuristics. Those
+        // pairs co-occur in essentially every non-trivial Rust file (bounded
+        // `for x in collection { v.push(y) }` is normal code), so they
+        // generated ~60 critical findings per average repo with no signal.
+        // Dropped in favour of the explicit-keyword / tiny-capacity /
+        // unlimited-read signals below, which remain specific enough to be
+        // useful.
+        let has_unbounded_allocations = code_only.contains("unbounded")
+            || code_only.contains("no_bound")
+            || code_only.contains("no_limit")
+            || code_only.contains("boundless")
+            || code_only.contains("unlimited")
+            || code_only.contains("unconstrained")
+            // `infinite` matches Rust std `f64::is_infinite()`, which is
+            // benign. Require the word in a non-method-call context.
+            || (code_only.contains("infinite") && !code_only.contains("is_infinite"))
+            // Unterminated recursion lacking any depth guard.
+            || (code_only.contains("recursion") && !code_only.contains("depth"))
+            // Suspiciously small initial capacity for a growing vector.
+            || code_only.contains("with_capacity(0)")
+            || code_only.contains("with_capacity(1)")
+            // Network / I/O primitives that slurp without a cap.
+            || (code_only.contains("read_to_end") && !code_only.contains("limit"))
+            || (code_only.contains("read_to_string") && !code_only.contains("limit"));
 
         if has_unbounded_allocations && !is_test_file {
             weak_points.push(WeakPoint {