Fix: react hook hidden mutation noise

[alxxjohn]

PR Summary

This PR hardens CodeGuard’s precision around high-volume false positives seen while dogfooding against TypeScript/JavaScript React/Next codebases.

Key changes:

• Reduces function.hidden-mutation noise for React hooks, local builders, collectors, accumulators, script entrypoints, and Next route handlers.

• Keeps real hidden side effects detectable, including collaborator mutations like repo.save(...), parameter mutation, and external resource
  mutation.

• Recognizes common command/event-style names such as submit, upload, download, notify, fetch, list, read, exists, seed, apply, sync, approve, and
  related verbs.

• Hardens quality.ambiguous-name for conventional UI/render-prop names like value, values, item, items, and data in React/UI callback contexts.

• Prevents function.command-query-mix from flagging React components/hooks and framework-required Next GET / POST handlers.

• Improves quality.duplicated-knowledge by including the duplicated literal in the finding message and skipping obvious UI display/class strings.

• Tightens naming.cardinality-mismatch to require stronger type evidence and ignore common framework names like args, props, searchParams, next,
  out, ids, and rows.

• Prevents quality.mutable-global-state from misclassifying local React/component bindings as module-level mutable state.

• Allows common UI boolean prop names like open, loading, active, and pending in React/UI contexts for naming.boolean-not-predicate.

• Refines design.persistence-model-leak so generated Prisma enum imports and TypeScript Record<...> utility types are not treated as ORM model
  leaks.

Tests added/updated:

• React hook hidden-mutation regression coverage.
• Cross-language local mutation coverage for TS, JS, Python, Go, and C++.
• Next route handler and script entrypoint coverage.
• UI false-positive coverage for ambiguous names, boolean names, mutable globals, cardinality naming, duplicated literals, command-query mix, and
  Prisma enum imports.

Validation:

go test ./...
make codeguard-ci

Both pass.