go: every quoted import counts safety_bypasses (dot-import alternation's dot is optional) #2542

Summary

Found by the #1096 control corpus: go's safety_bypasses rule counts every quoted import, not just dot-imports. The alternation \bimport\s+(?:\.[ \t]+)?" makes the dot optional, so import "fmt" matches the same as import . "fmt".

Evidence

Every corpus go file with an import records safety_bypasses +1 beyond its plants (main.go 1 with zero planted; b.go 3 = two _ = + the import). finditer-confirmed.

Impact

Every import statement in every real go repo contributes bypass/safety-negative mass — dwarfing the actual dot-import smell the alternation was presumably written to catch.

Fix shape

Make the dot mandatory in that alternation: \bimport\s+\.[ \t]+".

References

#1096 corpus ledger go-import-counts-bypass.