feat(facts): the [[layout]] fact -- vendored trees are out, test paths are not product

Two decisions the maintainer made, as rows rather than constants. A vendored tree (vendor/, node_modules/,
third_party/) is somebody else's unit: out of the targets in preprocess and out of the graph through the
frontend's --exclude, which the scan hands to the backend because the CPG seam imports only the standard
library. A test path (tests/, test-*.php, *Test.php) stays in scope -- a test that reaches a sink still
names the sink -- but its regions are not shipped and order after the product's. Measured before the row:
207 of WP Statistics's 357 PHP files were vendored, and 14 of the 67 regions ahead of MW WP Form's CVE
were test files. The position benchmark applies both, so it measures the order the scan spends.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/ranking/position.py

@@ -38,7 +38,9 @@ def ordered_regions(root: Path) -> list[ScanRegion]:
     regions = regions_for(analyze_entry_points(root, targets), targets, shipped=declared_sources(root))
     # The scan's own total order. If this drifts from scan.py the baseline measures the wrong thing, which
     # is why the sort key is the one thing here worth a test against the driver.
-    return sorted(regions, key=lambda r: (not r.shipped, -r.rank, r.path, r.function or ""))
+    from openultrasast.model.layout import with_layout
+
+    return sorted(with_layout(regions), key=lambda r: (not r.shipped, -r.rank, r.path, r.function or ""))
 
 
 def evidence_ordered_regions(root: Path, regions: list[ScanRegion], language: str) -> tuple[list[ScanRegion], dict[str, object]]:
@@ -58,7 +60,9 @@ def evidence_ordered_regions(root: Path, regions: list[ScanRegion], language: st
     started = time.monotonic()
     # The RECIPE's language, never the first region's: WP Statistics's first region is JavaScript, and a
     # build asked for as JavaScript went looking for jssrc2cpg and lost the whole repository's measurement.
-    cpg = backend.build(root, language=language)
+    from openultrasast.model.layout import vendored_directories
+
+    cpg = backend.build(root, language=language, exclude=vendored_directories(root))
     build_seconds = round(time.monotonic() - started, 1)
     if cpg is None:
         raise SystemExit(f"no graph for {root}: {getattr(backend, 'last_failure', '')}")