fix(scan,taint): TypeScript's limit is owned by TypeScript; a source pattern is a token

Two defects found by the cause-B rescan of the independent population (exploratory,
a retune after protocol-v1):

- `typescript_property_support_unvalidated` still reached the whole repository.
  YesWiki is a PHP application that ships a few `.ts` files, and all 1,128 of its PHP
  questions were unresolved. The limit is now owned by the TypeScript partition. A
  TypeScript project (Mockoon, Signal K) is unchanged.
- `isSourceCall`, and the method-level "reads a source" heuristics, matched source
  patterns as substrings. Flask's `request.get` therefore claimed Django's
  `request.get_host()`. wger's fix passes that host to
  `url_has_allowed_host_and_scheme`, and both fixed functions were reported as open
  redirects from it. Patterns are now matched as bounded tokens, like sinks and
  sanitizers. wger's vulnerable-pin detections rest on `request.GET`, which still
  matches.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_model_scope.py

@@ -453,3 +453,18 @@ def test_a_language_no_frontend_reads_demotes_only_its_own_questions(tmp_path):
     assert gap and gap[0].get("census_language") == "go", result.degradations
     assert "frontend_unsupported" in result.scope.unresolved_boundaries
     assert result.question_outcomes[0].status == "completed", result.question_outcomes
+
+
+def test_unvalidated_typescript_demotes_only_typescript_questions(tmp_path):
+    """YesWiki is PHP with a few `.ts` files; the TypeScript limit made every one of its PHP questions unresolved."""
+    root = source(tmp_path, "app.py", "widget.ts")
+    result = scan_repository(
+        root,
+        [region("app.py"), region("widget.ts", "typescript")],
+        backend=Backend({"app.py": vector(), "widget.ts": vector()}),
+        population_complete=True,
+    )
+    gap = [d for d in result.degradations if d.get("reason") == "typescript_property_support_unvalidated"]
+    assert gap and gap[0].get("census_language") == "typescript", result.degradations
+    status = {o.identity.path: o.status for o in result.question_outcomes}
+    assert status == {"app.py": "completed", "widget.ts": "unresolved"}, status