Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/cpp/positive.cpp

@@ -0,0 +1,49 @@
+// Positive fixture: each snippet should trigger the named pattern.
+#include <cstdlib>
+#include <cstring>
+#include <cstdio>
+
+// cpp.memory.gets
+void trigger_gets() {
+    char buf[64];
+    gets(buf);
+}
+
+// cpp.memory.strcpy
+void trigger_strcpy(const char *src) {
+    char dst[32];
+    strcpy(dst, src);
+}
+
+// cpp.memory.strcat
+void trigger_strcat(const char *extra) {
+    char buf[64] = "prefix";
+    strcat(buf, extra);
+}
+
+// cpp.memory.sprintf
+void trigger_sprintf(const char *name) {
+    char buf[128];
+    sprintf(buf, "Hello %s", name);
+}
+
+// cpp.cmdi.system
+void trigger_system(const char *cmd) {
+    system(cmd);
+}
+
+// cpp.memory.reinterpret_cast
+void trigger_reinterpret_cast() {
+    int x = 42;
+    float *fp = reinterpret_cast<float*>(&x);
+}
+
+// cpp.memory.const_cast
+void trigger_const_cast(const int *p) {
+    int *q = const_cast<int*>(p);
+}
+
+// cpp.memory.printf_no_fmt
+void trigger_printf_no_fmt(char *user_data) {
+    printf(user_data);
+}