fix: avoid false parser limits and reference accounting failures - #507

Ordinary skill documentation can trigger false static_parse_limit warnings and fatal reference-accounting errors, producing CLI exit code 2. This PR fixes those failures while preserving partial coverage for commands that cannot be reconstructed safely.

• Distinguish simple runtime parameters from command substitutions and complex expansions. Inline $ARGUMENTS, skill invocation syntax, and PowerShell member access no longer produce false parser-limit errors.
• Count directly scanned literal characters separately from already-consumed quoted spans, so long quoted documentation does not exhaust the wrong parser budget.
• Deduplicate coverage findings by source file, line, and target, and emit one completion event per source line containing all finding IDs. Markdown label/destination duplicates and distinct targets on one line no longer cause fatal unaccounted_work errors.
• Preserve partial coverage for runtime-selected printf, env, command, and builtin executable paths. A familiar basename does not make a runtime-selected executable deterministic.

Includes #508, merged into this PR's source branch as f5bb619. Fixes #464.

Validation:

• 629 tests passed across security reconstruction, reference finalization, and security end-to-end suites on the combined implementation. The current branch has the same file tree as that tested implementation; the subsequent CI-refresh commit changes no files.
• Six focused runtime-path probes change from incorrect completed coverage before fix: preserve partial coverage for runtime printf paths #508 to partial coverage with fix: preserve partial coverage for runtime printf paths #508. Markdown runtime-parameter controls remain complete, and the literal destructive-command control remains detected.
• Fresh ruff check src tests and ruff format --check src tests passed after the merge.
• The earlier fix: avoid false parser limits and reference accounting failures #507 revision was replayed against 31 affected skill inputs with --no-llm: all had successful scanner execution and no fatal accounting errors. Some retained blocking findings. This corpus replay predates fix: preserve partial coverage for runtime printf paths #508 and is not claimed as a fresh combined-corpus or full LLM/CI rerun.

Unresolved references and other analysis limitations remain visible. Downstream validation with LLM analyzers must be rerun after release adoption.

Prepared and updated by Codex on behalf of Mohit Gupta. The runtime-path follow-up in #508 was contributed by Yashraj.