fix(cpg): a sink is matched as a word, not as a substring

`fgets` contains `gets`. The sink matcher's last clause was an unbounded
`methodFullName.contains(n)`, so every bounded read in libpng matched the
sink for the unbounded one. All 26 entailed findings on that repository
were the same false positive:

  *argv -> fgets(pnmline, 256, wpng_info.infile)   (line 335, 8 steps)

which is the safe API being reported as the dangerous one -- and `fgets`
is in the fact tables as a SOURCE, never a sink. Verified against the CPG:
methodFullName is exactly "fgets", and .contains("gets") is true.

Third instance of one bug class in this codebase, after the sanitizer that
matched `resolve` inside `resolveUrl` and the discharger that matched
`user` inside `users`. The sink matcher had never been given the same
treatment. All four of its clauses now run through the shared bounded
matcher, and that matcher is the punctuation-tolerant version written for
task 2.6 -- so `input(`, which an unconditional lookahead had made
unmatchable in `input(x)`, works for the first time as well.

  libpng entailed   26 -> 0

Zero is the right answer for a PNG library whose only known CVE is out of
family. Gates byte-identical, so no pair outcome depended on the substring
match.

What remains on that scan is recorded, not claimed: 113 `c-unsafe-*` rows
assert an API is present rather than misused, and 50 overlay-coverage rows
are annotations rather than findings. 82 of the 113 are under `contrib/`.
Task 2.11 covers whether that band is worth putting in front of a
contributor at all; 2.10 already covers not scanning example code.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

.kiro/specs/contributor-scan/tasks.md

@@ -197,6 +197,18 @@
   - _Requirements: 5.1, 8.1_
   - _Depends: 2.4_
 
+- [ ] 2.11 The suspicion band has to be worth reading
+  - libpng's scan produced 198 rows: 26 entailed (all one false positive, since fixed), 113 `c-unsafe-*`
+    pattern matches that assert an API is PRESENT rather than misused, 50 overlay-coverage annotations that
+    are not findings at all, and 9 model suspicions. Zero validated defects.
+  - The rung is honest -- these say "needs review" and mean it -- but a contributor handed 163 rows about a
+    library that uses `memcpy` correctly throughout will not read the one that matters. 82 of the 113 are in
+    `contrib/`, so task 2.10 removes most of it; what remains needs a policy, not a filter invented here.
+  - Observable: a stated rule for what reaches a contributor's report at `suspicion`, and libpng's row count
+    under it, measured.
+  - _Requirements: 5.1, 5.2_
+  - _Depends: 2.10_
+
 - [ ] 2.10 Do not spend the scan on example code
   - 22 of libpng's 30 highest-ranked regions are under `contrib/` -- the sample programs shipped with the
     library rather than the library. The budget and the 243s taint query go there first.