When debug observability is enabled, the false_positive.multipass.excluded_match
metric now includes an sds_excluded_namespace tag identifying which excluded
path contributed the match that caused the false positive.

Changes:
- excluded_matches changed from AHashSet<String> to AHashMap<String, String>
  to track the contributing path as a pre-formatted string
- TruePositiveSearch stores a &Path reference (zero-cost) and only calls
  to_string() at the insert point when debug observability is enabled;
  otherwise stores an empty string (no allocation)
- Added multipass_excluded_scan benchmark to catch performance regressions

Benchmark (multipass_excluded_scan):
  main (baseline): 27.0 µs
  this branch:     26.7 µs (no regression)