feat(ir): add TrackedParam struct and SinkVar fields (PR-02)

[shivasurya]

Summary

• Add TrackedParam struct to ir_types.go with Index *int, Name string, Return bool fields
• Add TrackedParams []TrackedParam to both CallMatcherIR and TypeConstrainedCallIR
• Add SinkParamIndex/SinkParamName to DataflowDetection for reporting which parameter was tainted
• Add SinkVar to TaintDetection populated from usedVar in FindTaintFlows() — records which variable at the sink carries taint
• Add TrackedParams to CallSiteMatch for carrying tracking info through the executor pipeline
• Structural changes only — no filtering logic (that's PR-03)

Test plan

• gradle buildGo passes
• gradle testGo passes (zero regressions)
• gradle lintGo passes (0 issues)
• gradle lintPython passes
• No behavior changes — purely additive struct fields with omitempty

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.84%. Comparing base (5254dda) to head (9298363).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #606   +/-   ##
=======================================
  Coverage   83.84%   83.84%           
=======================================
  Files         155      155           
  Lines       20936    20937    +1     
=======================================
+ Hits        17554    17555    +1     
  Misses       2739     2739           
  Partials      643      643           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• test(executor): tracked param integration tests (PR-04) #608
• feat(executor): wire tracked param filtering (PR-03) #607
• feat(ir): add TrackedParam struct and SinkVar fields (PR-02) #606 👈 (View in Graphite)
• feat(sdk): add .where() and .tracks() parameter targeting APIs (PR-01) #605
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Mar 14, 3:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 14, 3:18 AM UTC: Graphite rebased this pull request as part of a merge.
• Mar 14, 3:19 AM UTC: @shivasurya merged this pull request with Graphite.

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	3
Rules	38

---

_{Powered by Code Pathfinder}