Trust-gate TypeScript semantic runtime (prevent execution of repo-local runtimes)

[alxxjohn]

Motivation

• The semantic TypeScript analyzer previously discovered node_modules/typescript/lib/typescript.js under the scanned target and its ancestors, which allowed repository-controlled JavaScript to be executed by the scanner.
• The change aims to eliminate automatic execution of repository-local TypeScript runtimes while preserving an explicit operator override and the bundled trusted runtime.

Description

• Stop walking the target/ancestor paths for node_modules/typescript/lib/typescript.js and restrict automatic discovery to an explicitly configured CODEGUARD_TYPESCRIPT_LIB_PATH and the bundled VS Code runtime. (updated discoverTypeScriptLibPath).
• Remove the ancestor-path candidate construction so repository-local node_modules runtimes are never selected automatically. (deleted typeScriptLibCandidates / ancestorPaths).
• Add regression tests that verify repository-local runtimes are ignored and that an explicit CODEGUARD_TYPESCRIPT_LIB_PATH is honored. (updated internal/codeguard/checks/support/typescript_semantic_test.go).
• Update documentation to explain the trusted-runtime-only discovery policy and the fallback to parser-based checks. (updated docs/checks.md).

Testing

• go test ./internal/codeguard/checks/support ./tests/checks — succeeded.
• go test ./... — succeeded.
• git diff --check — succeeded.

---

Codex Task