fix(hunt): build output gets no candidate rows, a minified line is not scanned once per function, the screen checkpoints every change

The second access-control screen spun for 2h20m on one ordinary mage-ai change: a Next.js build commit whose 3 MB
one-line bundles hold 12,355 functions each. `source.ranges_from_ir` ran two regex scans of the whole line once per
function, and the screen kept its 422 finished changes in memory only, so stopping it lost them.

- `source.ranges_from_ir`: a line over MINIFIED_LINE_CHARS (2000) is not checked per function; JavaScript names on it
  stay anonymous, other languages keep the parser's name.
- `source.generated_reason`: why a changed file is build output (a directory the product walk leaves out, a minified
  name, over MAX_FILE_BYTES, a line over the cap). `hunt.producers._candidates` leaves such files out and records the
  reason on the context; the fix site of a vulnerability is always kept. The DSPy arm shares the enumeration.
- The screen writes rows.jsonl and log.jsonl per change (rows first, entry last) and resumes by skipping logged ids.

Tests: the minified line never reaches the per-function scan; generated_reason on the four shapes and two source files;
build output in an ordinary change yields no rows while a vulnerability path in a one-line file is kept.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/test_hunt_producers.py

@@ -256,3 +256,18 @@ def test_obligation_loader_errors_remain_type_only(repository, monkeypatch):
     assert row["provenance.semantic.ok"] is False
     assert row["provenance.semantic.reason"] == "OSError"
     assert "private file contents" not in json.dumps(row)
+
+
+def test_build_output_in_an_ordinary_change_gets_no_candidate_rows(repository):
+    root, change = repository
+    (root / "dist").mkdir()
+    (root / "dist" / "bundle.js").write_text("function a() {}\n")
+    (root / "app.min.js").write_text("function b() {}\n")
+    (root / "one.js").write_text("".join(f"function f{i}(){{}}" for i in range(400)) + "\n")
+    (root / "big.js").write_text("function c() {}\n" + "// padding\n" * 100_000)
+    files = [{"path": p, "head_lines": [[1, 1]]} for p in ("dist/bundle.js", "app.min.js", "one.js", "big.js", "app.py")]
+    rows = candidate_rows(root, {**change, "kind": "ordinary", "files": files})
+    assert {row["path"] for row in rows} == {"app.py"}
+    # The fix site of a vulnerability is kept whatever the file looks like.
+    kept = candidate_rows(root, {**change, "path": "one.js", "function": "f0", "function_lines": [1, 1], "files": files[2:3]})
+    assert [row["path"] for row in kept] == ["one.js"]