test(project): complete coverage and self-analysis

[batuthzcode]

Summary

• completes the remaining CLI, exit-code, JSON, OSV, rule, and demo tests
• raises combined statement and branch coverage to 98.6%
• enforces a 97% coverage floor in GitHub Actions
• adds deterministic whole-project self-analysis generation and drift checking
• stores the canonical project analysis report
• documents findings, coverage exclusions, and reproduction commands

Self-analysis result

The initial project scan returned 10 findings. Four maintainability findings in tests were refactored, and one test-fixture false positive was removed without weakening the hardcoded-secret rule test.

The final report contains exactly five intentional true positives from sample_app/analyzer_demo.py. There are no known false positives in the final report.

Verification

• 1044 tests passed
• combined statement/branch coverage: 98.6%
• required CI coverage: 97.0%
• workflow YAML and pyproject TOML parsing passed
• Python compile check passed
• sample-app reports are current
• whole-project self-analysis report is current
• git diff check passed