test(dependency-sources): verify configured scan budget behavior - #1

Add 10 simulated-clock regression cases for the runtime behavior of the configurable dependency-source ceiling in NVIDIA/SkillSpector#705.

The tests verify that raising the ceiling allows the same scan to finish beyond the historical 5-second limit, while shorter caller deadlines, exhausted budgets, retained findings, and partial analyzer status remain respected. They also cover a slow parse that emits no findings. No production code changes are included.

This PR targets your fix/dependency-source-analysis-budget branch so the tests can be incorporated into NVIDIA#705. The single signed-off commit can also be cherry-picked: 0c1f3bcf85082e67f3f13f19b05ef1c4de5f7b97.

Validation:

• 357 related tests passed, including the new behavior cases, your configuration tests, dependency-source regressions, and source detection tests.
• Repository-wide Ruff lint and format checks passed.
• In separate processes, restoring a fixed 5-second ceiling caused 3 selected tests to fail; ignoring the caller deadline caused 4 selected tests to fail. These mutations were simulated in memory and were not committed.

The tests use a private clock and synthetic .invalid registry destinations; they do not sleep or contact registries.