Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/cpp/negative.cpp

@@ -0,0 +1,24 @@
+// Negative fixture: none of these should trigger security patterns.
+#include <cstdio>
+#include <cstring>
+#include <string>
+
+void safe_string_ops() {
+    std::string s = "hello";
+    std::string copy = s;
+    auto len = s.length();
+}
+
+void safe_cast() {
+    double d = 3.14;
+    int i = static_cast<int>(d);
+}
+
+void safe_snprintf(const char *name) {
+    char buf[128];
+    snprintf(buf, sizeof(buf), "Hello %s", name);
+}
+
+void safe_printf_literal() {
+    printf("Hello %s\n", "world");
+}