The §20.2 static AST guard for selected test files (Plan 184).
Purpose
-------
Implement the stand-in's static contract subset (spec-10 §10/§20.2):
raw ``os.chdir`` calls (rule ``cwd_chdir``) and the four raw
environment-mutation forms §6.4 names — subscript assignment, ``del``,
``os.environ.update(...)``, ``os.putenv(...)`` — (rule
``env_mutation``), both error severity; plus the advisory literal-path
owned-write pre-check (rule ``owned_writes_outside_tmp``).
Responsibilities
----------------
- ``scan_files`` — parse each selected test file and return §11-shaped
violation entries (``nodeid`` is ``None`` for static findings; the
line number is carried in the message).
- The approved-container exemption: calls inside a function decorated
with ``@pytest.fixture`` (bare or called form) are exempt — the
stand-in's reading of §6.1/§6.4 "approved fixtures"; v1.0 refines
this with config-declared fixture inventories.
Diagnostics
-----------
Domain: OC_TESTING
Levels:
L2 — lifecycle events
L3 — semantic details
L4 — deep tracing
Contracts
---------
- The scan covers exactly the four §6.4-named env forms; other mapping
mutators (``pop``, ``setdefault``, ``clear``) are v1.0 scope.
- String/docstring mentions never match (AST, not grep).
- Advisory findings never drive an exit code (§11: only error-severity
entries produce exit 2).
Dependencies
------------
- oc_diagnostics (structured debug logging via _dbg)
- oc_chat.testing.report (violation constructor)