Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/rust/negative.rs

@@ -0,0 +1,36 @@
+// Negative fixture: none of the security-relevant patterns should fire here.
+
+fn safe_option_handling() {
+    let x: Option<i32> = Some(1);
+    // Using match instead of unwrap
+    match x {
+        Some(v) => println!("{}", v),
+        None => println!("none"),
+    }
+}
+
+fn safe_result_handling() -> Result<(), String> {
+    let x: Result<i32, String> = Ok(1);
+    // Using ? instead of unwrap
+    let _v = x?;
+    Ok(())
+}
+
+fn safe_copy() {
+    let src = vec![1, 2, 3];
+    let mut dst = vec![0; 3];
+    // Safe copy via clone
+    dst.clone_from(&src);
+}
+
+fn safe_cast() {
+    let x: u32 = 42;
+    // Widening cast is fine
+    let _ = x as u64;
+}
+
+fn safe_string_ops() {
+    let s = String::from("hello");
+    let _ = s.len();
+    let _ = s.is_empty();
+}