fix: honor tsconfig source boundaries or make whole-repository discovery explicit

[rahlk]

Problem

The analyzer loads one config's compiler options but ignores its files / include / exclude source program. discoverSourceFiles() recursively adds every TypeScript-family file outside a small hard-coded skip list. This makes the output neither a compiler-program graph nor a clearly labeled whole-repository graph.

It also makes --skip-tests heuristic: test files whose path does not match *.spec.*, *.test.*, or one of a few directory names are still included.

Related to #56, but independently observable even in a single-config project.

Reproduction

In OWASP Juice Shop 6244c59:

• root tsconfig.json explicitly excludes data/static/codefixes/**;
• analysis.json nevertheless contains all 92 alternate challenge snippet files from that directory and 44 call edges sourced from them;
• those files are intentionally non-runtime answer/distractor variants and can duplicate or contradict the deployed implementation.

The same --skip-tests run also includes:

• cypress.config.ts (13 call edges);
• frontend/src/test-setup.ts;
• frontend/src/mocks/ng-gallery.ts;
• four rsn/ development-tool files (43 call edges);
• frontend build tooling.

For comparison, tsc --listFilesOnly over frontend/src/tsconfig.app.json reports 169 first-party application files; all are present, but the analyzer adds five frontend files outside that production program.

Root cause

• src/syntactic_analysis/discovery.ts walks the filesystem by extension and hard-coded directory names.
• src/syntactic_analysis/symbolTable.ts creates the project with skipAddingFilesFromTsConfig: true, then manually adds every discovered file.
• Compiler-program inclusion/exclusion is therefore never used as the source-of-truth.

Expected behavior

The output should have an explicit, predictable scope. The default should either follow configured compiler projects, or whole-repository analysis should be an explicit mode with scope metadata so consumers can distinguish runtime, test, tooling, and snippet nodes.

Acceptance criteria

Choose and document one of these contracts:

1. Default to the union of source files in discovered compiler projects; add an explicit --whole-repo mode for recursive discovery; or
2. Keep whole-repo discovery, but label each module with its owning project/config and scope (application, test, tooling, unowned, etc.), and make --skip-tests use project membership as well as filename heuristics.

Additionally:

• honor explicit exclude patterns in compiler-program mode;
• do not include spec-config-only setup/mocks when --skip-tests is active;
• report unowned discovered files rather than silently mixing them into the runtime graph;
• add regression coverage for an excluded snippet directory and separate app/spec configs;
• preserve an opt-in path for repository-wide knowledge-graph use cases.