Fix semantic analyzer false positives for Python sinks

[jstar0]

Summary

Fixes #119.

This PR reduces Python semantic analyzer false positives where clean MCP tools are reported as using subprocess, exec, open, or fetch based on unrelated source or plain text.

Changes

• Bound Python cross-file import expansion to modules reachable from the handler directory and parent package tree, instead of matching any same-named module across the scanned repository.
• Replaced Python behavioral sink substring matching with AST call detection for known sink calls.
• Tightened the command execution snippet fallback so words such as subprocess or exec are not treated as command execution unless they appear in call-shaped patterns.
• Added regression tests for the from mcp.server.fastmcp import FastMCP layout, the Error fetching entity... string case, and command execution substring-only snippets.

Verification

uv run pytest tests/test_semantic.py tests/test_module_taint.py tests/test_analyzers.py tests/test_behavioral_eval.py tests/test_new_features.py tests/scoring/test_analyzer_evidence.py tests/analyzers/test_finding_facts.py tests/reporting/test_runtime_evidence.py tests/scoring/test_runtime_evidence_scoring.py -q
uv run ruff check src tests
uv sync --all-extras
uv run pytest -q