feat(model): one finding per sink site, and WordPress's registration model

contributor-scan 5.4. Both halves, and the second found a frontend blocker.

**One verdict per region was right for a pair and wrong for a file.** A
pair is one labelled function with one bug, so one answer is correct. A
region spanning a PHP file is not: the probe's SQL injection on line 5 and
command injection on line 13 produced ONE injection verdict, `system` won
it on flow length, and the SQL injection went unreported by construction
rather than by any failure of the analysis.

`taint.verdicts()` now returns one verdict per distinct sink site,
strongest first, and its first element is exactly what `verdict()`
returns -- so the pair path and every committed measurement resting on it
are unchanged, and the gates are byte-identical. Both entry points share
`_usable_flows` so neither can drift from the other.

  php probe   2 of 3 -> 3 of 3
  vampi       6 entailed, unchanged, now with lines on access-control
              findings from task 2.7 (users.py:187, books.py:51 -- the two
              documented BOLAs at their exact lines)
  libpng      1 -> 2 entailed; the second was hidden by the collapse.
              Neither is validated and both are in contrib/.

**WordPress registers handlers rather than decorating them, and the hook
name is the declaration.** `wp_ajax_nopriv_*` is WordPress saying
logged-out callers reach this, so it is public; `wp_ajax_*` fires only for
logged-in ones; `permission_callback => __return_true` declares a REST
route open. That is the declared-provenance signal task 2.8 needs,
arriving from a second framework. Plus every top-level PHP function as its
own region, without which a file is one region however many functions it
holds: 1 file-level region became 10 function-scoped ones.

**And a blocker, recorded as 5.5.** php2cpg emits a CPG containing only
ONE PHP file, the last alphabetically. Reproduced twice on independent
samples; both files parse cleanly under `php -l` and under PHP-Parser
directly, and joern-parse reports success either way. php2cpg logs "Found
warning in PHP-Parser JSON output" naming the survivor, and that warning is
PHP-Parser's own `====> File X:` banner appearing in what php2cpg expects
to be pure JSON.

Not isolated yet: this machine has no PHP interpreter, so php2cpg was
driven through a container shim. The banner comes from PHP-Parser rather
than the shim, which makes a shim-only cause unlikely but not excluded, and
rerunning with the native php-cli in the shipped image is the first step.
It blocks WordPress outright -- a plugin is many files, and a scan that
silently covers one of them and reports success is the quiet failure Req
5.6 was approved for.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

.kiro/specs/contributor-scan/tasks.md

@@ -408,7 +408,7 @@
   - _Requirements: 9.2, 9.4, 9.5, 9.6_
   - _Depends: 4.1_
 
-- [ ] 5.4 WordPress entry points, and the one-verdict-per-region limit
+- [x] 5.4 WordPress entry points, and the one-verdict-per-region limit
   - Two things stand between the PHP facts and a WordPress result, and the second was found by running the
     first.
   - **Entry points.** WordPress registers handlers with `add_action`, `add_filter`, admin-ajax and REST
@@ -425,6 +425,23 @@
   - _Requirements: 2.1, 8.1, 9.1_
   - _Depends: 5.1_
 
+- [ ] 5.5 php2cpg emits a CPG containing one file
+  - **Found by 5.4 and it blocks the WordPress target.** A CPG built over two PHP files contains only one,
+    and the survivor is the last alphabetically. Reproduced twice on independent samples; both files parse
+    cleanly under `php -l` and under PHP-Parser directly, and `joern-parse` reports success either way.
+  - php2cpg logs `Found warning in PHP-Parser JSON output` naming the surviving file, and that warning is
+    PHP-Parser's own `====> File X:` banner appearing in what php2cpg expects to be pure JSON. That is the
+    thread to pull.
+  - Not yet isolated: this machine has no PHP interpreter, so php2cpg was driven through a container shim.
+    The banner comes from PHP-Parser rather than from the shim, which makes a shim-only cause unlikely but
+    not excluded. **Rerun with the native php-cli in the shipped image first.**
+  - A plugin is many files. A scan that silently covers one of them and reports success is exactly the quiet
+    failure Req 5.6 was approved for.
+  - Observable: a CPG over N PHP files contains N files, or a recorded reason it cannot with the version and
+    the reproduction.
+  - _Requirements: 4.3, 5.6, 9.1_
+  - _Depends: 5.4_
+
 ## Group 6 — Regression baselines
 
 - [ ] 6.1 Repository baseline and delta