…IXED_RAW FP)

Completes the taint_join->least_trusted migration started in wardline-4d94577013
(L2 expression combiners) and wardline-4d9f840c24 (L2 control-flow merges). The
four remaining taint_join call sites — the CALLEE-COMBINATION joins in the L3
call-graph propagation engine — are switched to the rank-meet least_trusted:

  - minimum_scope.py  _refine callee aggregation
  - propagation.py    _compute_scc_round per-round refinement
  - propagation.py    Phase 1 external-influence aggregation
  - propagation.py    Phase 1b multi-source seed-join

Evaluated each site independently (the task was to DECIDE, not assume): all four
are the SAME shape — a function-summary AGGREGATION of the influence of a *set*
of callees into one taint, never a single value built by merging two
provenances. taint_join's MIXED_RAW models a single-value provenance clash,
which has no referent at the function-summary level; the precise single-value
combination (e.g. `return a() + b()`) is already resolved at L2, which itself
uses least_trusted. So a non-anchored function calling two clean-but-different-
family callees (e.g. an ASSURED validator and an INTEGRAL helper) spuriously
became MIXED_RAW (rank 7, in the firing RAW_ZONE); propagated up it fired
PY-WL-101 on clean data — the same FP shape as the L2 merges.

Fail-safe: least_trusted <= taint_join in rank always, so this only ever LOWERS
a combined rank — removes over-flags, never creates under-flags. RAW_ZONE
collapses MIXED_RAW with the other raw states, so a genuinely-raw callee keeps
its rank and still fires; the two operators can only diverge on a firing
decision when least_trusted yields a clean state and taint_join yields MIXED_RAW
(the clean-but-different-family case), which is always the false positive.

taint_join itself stays in core/taints.py (the operator is unchanged); the two
operators remain distinct. Stale docstrings rewritten: propagation.py's
module-header "combination uses taint_join / TRUST_RANK never for combination"
(now false — least_trusted IS a TRUST_RANK-based meet and is the combination
operator) and minimum_scope.py's "MIXED_RAW by design — the conservative
direction" (the exact rationale the L2 commits refuted). Per-site comments pin
the least_trusted choice so the question isn't reopened.

Tests: two buggy-MIXED_RAW assertions corrected to the precise least_trusted
value (test_propagation cyclic + two-anchored-callees; test_analyzer transitive
propagation now UNKNOWN_RAW, floored, not MIXED_RAW); clean-direction +
soundness-companion tests added for the minimum_scope and propagation sites
(two clean-different-family callees stay clean; one raw callee still
propagates). Verified: 936 pytest green, soundness battery 30/30 (no FN),
self-host 0 PY-WL defects, ruff + mypy --strict clean.

Closes wardline-17b9ce2c70

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>