feat(facts): the [[layout]] fact -- vendored trees are out, test paths are not product

Two decisions the maintainer made, as rows rather than constants. A vendored tree (vendor/, node_modules/,
third_party/) is somebody else's unit: out of the targets in preprocess and out of the graph through the
frontend's --exclude, which the scan hands to the backend because the CPG seam imports only the standard
library. A test path (tests/, test-*.php, *Test.php) stays in scope -- a test that reaches a sink still
names the sink -- but its regions are not shipped and order after the product's. Measured before the row:
207 of WP Statistics's 357 PHP files were vendored, and 14 of the 67 regions ahead of MW WP Form's CVE
were test files. The position benchmark applies both, so it measures the order the scan spends.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/preprocess.py

@@ -97,7 +97,7 @@ def enumerate_source_files(root: Path) -> list[Path]:
     patterns = _load_ignore_patterns(root)
     paths: list[Path] = []
     for path in root.rglob("*"):
-        if not path.is_file() or _has_ignored_dir(root, path) or _is_ignored(root, path, patterns):
+        if not path.is_file() or _has_ignored_dir(root, path) or _is_ignored(root, path, patterns) or _is_vendored(root, path):
             continue
         if detect_language(path) != "unknown":
             paths.append(path)
@@ -177,6 +177,15 @@ def _has_ignored_dir(root: Path, path: Path) -> bool:
     return any(part in IGNORED_DIRS for part in relative_parts[:-1])
 
 
+def _is_vendored(root: Path, path: Path) -> bool:
+    """A tree the `[[layout]]` facts call somebody else's code. Out of the targets entirely: a bundled
+    library is a separate unit, analysed as one or not at all (contributor-scan 5.13; the decision is the
+    maintainer's and lives in the fact table, not here)."""
+    from .model.layout import is_vendored
+
+    return is_vendored(path.relative_to(root).as_posix())
+
+
 def _is_ignored(root: Path, path: Path, patterns: list[str]) -> bool:
     relative = path.relative_to(root).as_posix()
     return any(fnmatch.fnmatch(relative, pattern) or fnmatch.fnmatch(path.name, pattern) for pattern in patterns)