[SizzleUnrlsd]

Summary

Opens Phase 8 of docs/architecture.md: the proof / refutation engine (§24). Every taint flow now gets a verdict before it becomes a finding.

• Acceptance tests first (test: define proof and refutation behavior), implementation follows.
• findings/refutation.py: RefutationAnalysis (findings.refutation) walks the dominators of the sink block; each branch whose one side alone reaches the sink fixes the truth of its condition there. Conditions are interpreted: string validators (isdigit(), isalnum(), ...), membership in a constant allowlist and equality with a constant prove a value safe; not, and and or combine as expected; a recognised check evaluated the wrong way yields nothing; any other condition mentioning the value is a guard that does not prove it. Proofs follow data dependencies, so a validated name stays validated inside "SELECT ... " + name, and every tainted origin of the argument must be proven.
• Verdicts: REFUTED (all origins proven, or the sink unreachable by constant propagation), HOTSPOT (an unproven guard mentions the value), VULNERABILITY (no guard at all). Each carries a one-line evidence string.
• TaintDetector consults the verdicts: refuted flows are dropped, hotspots are reported with medium confidence, vulnerabilities with high confidence; verdict and evidence go into the finding metadata. Detector manifests declare findings.refutation.

The §24 example, if not value.isdigit(): return before the sink, is refuted with guarded by isdigit().

Not in this PR: numeric range analysis, authorization guards, and a RefutationPlugin type letting plugins add evidence; the engine's rule set is fixed for now.

Part of #32