feat(executor): wire tracked param filtering (PR-03)

[shivasurya]

Summary

• Propagate TrackedParams through resolveMatchers() in both call_matcher and type_constrained_call branches
• Fix MatchedCallSite nil case: look up actual CallSite from call graph when TrackedParams are present
• Add 5 new helper functions: findCallSiteAtLine, resolveTrackedParamIndices, getParamNamesForFQN, matchesTrackedParams, resolveParamIndex
• Filter VDG detections in executeLocal() against sink TrackedParams before appending
• Filter inter-procedural flows in summaryConfirmsFlow() using resolveTrackedParamIndices()
• Populate SinkParamIndex on DataflowDetection
• Propagate SinkVar from TaintDetection to TaintInfo in AnalyzeWithVDG()
• Tier 3 (line-proximity fallback) intentionally skips tracked param filtering per spec

Test plan

• gradle buildGo passes
• gradle testGo passes (zero regressions)
• gradle lintGo passes (0 issues)
• Empty TrackedParams = identical behavior to before (backward compat)

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[shivasurya]

• test(executor): tracked param integration tests (PR-04) #608
• feat(executor): wire tracked param filtering (PR-03) #607 👈 (View in Graphite)
• feat(ir): add TrackedParam struct and SinkVar fields (PR-02) #606
• feat(sdk): add .where() and .tracks() parameter targeting APIs (PR-01) #605
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Mar 14, 3:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 14, 3:20 AM UTC: Graphite rebased this pull request as part of a merge.
• Mar 14, 3:21 AM UTC: @shivasurya merged this pull request with Graphite.

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	2
Rules	38

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 39.04762% with 64 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.62%. Comparing base (ec41e05) to head (e876b18).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
sast-engine/dsl/dataflow_executor.go	38.46%	60 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #607      +/-   ##
==========================================
- Coverage   83.84%   83.62%   -0.23%     
==========================================
  Files         155      155              
  Lines       20937    21030      +93     
==========================================
+ Hits        17555    17586      +31     
- Misses       2739     2798      +59     
- Partials      643      646       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.