taint tracking: keep a set of sources per name so reassignment can't drop the stronger TT rule #750

Summary

Follow-up from the review of #611 (fixes #610). The behavioral_taint_tracking analyzer keys taint by variable name, storing a single source per name. When a name is reassigned from different sources, only one source survives, so a sink can be attributed to the wrong source rule and a stronger TT finding can be lost.

Detail

_collect_tainted records one source_call per name (_mark_targets is add-only and keeps the first writer; main's single-pass kept the last writer). Either way, for:

secret = os.environ["API_KEY"]   # would drive the stronger rule (e.g. TT3/TT5)
secret = request.args.get("x")   # weaker/other classification
sink(secret)

the surviving source depends on write order (first-write under #611, last-write on main), and the other is dropped. An author could also order the writes to pick which rule fires. In both models the sink is still reported, but potentially under a weaker TT rule than one of its real sources warrants.

Proposed direction

Track a set of sources per name rather than a single source_call, and when a sink consumes a name, emit/classify against the strongest applicable source (or all of them). This keeps the order-independent, add-only, fire-once worklist from #611 — the value would become a set that only grows.

Notes

• Non-blocking for fix(taint): collect taint before checking sinks so order-independent flows aren't dropped #611 (raised by @rng1995 in that review); filing so the idea isn't lost.
• Scope: src/skillspector/nodes/analyzers/behavioral_taint_tracking.py (_collect_tainted, _mark_targets, _TaintedVar, and the sink-emission classification).