fix(taint): resolve lambda bodies against worst-ever var taint (fixes #19 FN)

[tachyon-beep]

Motivation

Fixes a validated high-severity false negative introduced by #19 (commit d99d336).

#19 resolved lambda bodies against the function's final variable taints. That fixed the deferred case where a captured variable is tainted after the lambda is defined — but introduced the symmetric false negative: a variable still raw when the lambda is called, cleaned only afterwards, was recorded clean and the sink suppressed:

@trusted(level='ASSURED')
def f(p):
    src = read_raw(p)
    cb = lambda: eval(src)
    cb()                # eval() runs on RAW data here
    src = "clean"       # cleanup happens AFTER the call

The non-lambda control (src = read_raw(p); eval(src); src = "clean") correctly fires PY-WL-107; the lambda version did not.

Root cause

A closure captures variables by reference and runs at an unknown call time ≥ its definition. So no single program-point snapshot is sound: definition-site misses "tainted after", final-state misses "called before cleanup". Both #18 (def-site) and #19 (final-state) picked one point and each missed one ordering.

Fix

Resolve each lambda body against the worst (least-trusted) taint each captured variable holds anywhere in the function — joined over every per-statement snapshot plus the final state (_worst_ever_var_taints). This is the fail-closed choice: it guarantees no false-negative across both deferred orderings.

When the per-statement snapshots are unavailable (a degraded caller that doesn't request flow-sensitive recording), the lambda pass is skipped so the sink rules fall back to their pessimistic UNKNOWN_RAW default — never silently masking a sink with a possibly-clean final value.

Soundness / precision

Case	result
raw → eval in lambda body	fires
raw assigned after lambda def (deferred)	fires
raw at call, cleaned after (the reported FN)	fires
lambda: eval("safe") (never raw)	no fire
lambda cmd: eval(cmd) (param shadows raw)	no fire

Documented residual: a conservative, waivable false positive — a variable raw only before the lambda captures it (x = read_raw(p); x = "clean"; cb = lambda: eval(x)) is treated tainted, because the analysis joins over the whole function rather than tracking the capture point. The safe direction for a security analyzer, pinned by a regression test, and verified not to fire on wardline's own source (dogfood: 0 new).

Testing

• New/updated regression tests in test_sink_rules.py: both deferred orderings fire (PY-WL-107/108), no-fire on clean local and shadowing param, and the documented conservative FP.
• Full suite 2356 passed, coverage 91.78%; ruff + mypy clean; dogfood 0 new.

🤖 Generated with Claude Code