bug: deterministic rules fire on own pattern definitions and test fixtures

[ajianaz]

Description

Deterministic security rules (sec-hardcoded-secret, sec-sql-concat, sec-tls-disabled, sec-hardcoded-url) match against their own pattern definitions in src/engine/rules/builtin.rs and test fixtures in src/engine/rules/mod.rs.

Findings from full codebase review

• builtin.rs:20 — sec-sql-concat matches the regex pattern string itself
• builtin.rs:38 — sec-tls-disabled matches the pattern string itself
• rules/mod.rs:419 — sec-hardcoded-secret matches test fixture password = "super_secret_123"
• rules/mod.rs:436 — sec-hardcoded-url matches test fixture http://example.com

All are false positives.

Expected Behavior

• Rule files (**/rules/**) should be excluded from rule scanning by default
• Test files (**/tests/**, **/*_test.rs) should be excluded or have lower severity

Fix

Add default exclude patterns to each builtin rule, or add a global exclude_source_files config.