[FEATURE/CORE-ENGINE] Extract a shared, scope-aware spatial correlation primitive and make threat_locations the persisted ledger #346

🛑 Problem Statement

The "spatial taint tracker" this epic (#102) wants fully integrated currently exists as three independent, disconnected systems:

1. detector.py::_correlate_signals — a char-offset proximity sweep, used inline six separate times inside coding_analysis(), each hand-written for one specific signal pair. Its raw position data (spatial_map) is discarded the moment coding_analysis() returns.
2. security_lens.py::scan_content — a genuine variable-identity echo check (tracks assigned variable names across threat-flagged lines), with its own siloed line-position math that never leaves the file.
3. threat_locations — a rule_name -> [line_numbers] dict that does survive to the end of the pipeline (into telemetry, SARIF, etc.), but nothing correlates against it today. It's write-only.

None of the six existing _correlate_signals calls have access to real function-level scope, because coding_analysis() (where they run) executes before _function_slice() (which computes satellite/function boundaries) in detector.py::splice(). They all use a flat character radius as a scope proxy, which produces both false positives (radius bleeds into a neighboring short function) and false negatives (a real same-function correlation exceeds the radius in a long function) — notably on the dampener side (safety/danger, sync_locks/concurrency, cleanup/memory_alloc), where a scope error silently suppresses real risk rather than just adding noise.

This also blocks #105 and #106 as currently written: both propose a new one-off correlation inside coding_analysis/prism.py, but #106's consumer (dev_agent_firewall.py) runs post-hoc over parsed_files at the same late pipeline stage as ai_appsec_sensor.py (galaxyscope.py:802-806) — well after coding_analysis()'s transient spatial_map is gone. A post-hoc tool structurally cannot consume spatial_map; it can only consume whatever survives into telemetry/threat_locations. So #106 cannot be implemented as literally scoped without this landing first.

🎯 Objective

Replace the three disconnected systems with one shared, reusable, scope-aware correlation primitive, and one persisted spatial ledger that survives to every pipeline stage — not just internal to detector.py.

🛠️ Proposed Implementation

• Split detect from correlate: Move all spatial correlation (the six existing _correlate_signals calls) into a new pass that runs after both coding_analysis() and _function_slice(), so it can filter each signal's hit positions down to the owning satellite's [start_idx, end_idx] before correlating — instead of running mid-scan before satellites exist.
• Extract the primitive: Pull _correlate_signals out of detector.py into its own module so it's callable from post-hoc tools (dev_agent_firewall.py, ai_appsec_sensor.py, signal_processor.py), not just from inside coding_analysis.
• Upgrade the ledger: Extend threat_locations to carry char offset and owning-satellite/function id per hit, not just line number, and merge security_lens.py's already-computed line positions (e.g. for db_hooks) into it instead of discarding them after producing a flat count.
• Migrate the six existing calls onto the new primitive, prioritizing the three dampener pairs first (safety/danger, sync_locks/concurrency, cleanup/memory_alloc) since scope errors there are false negatives, not just noise.

✅ Acceptance Criteria

• Spatial correlation runs after satellite boundaries exist, and can filter to a single function's range.
• threat_locations (or its successor) is populated and readable by post-hoc tools outside detector.py, including dev_agent_firewall.py and ai_appsec_sensor.py.
• All six existing _correlate_signals call sites are migrated onto the shared primitive with no behavior regression (covered by tests).
• No measurable ingestion-velocity regression (checked via the existing FILE_SPEED/regex_telemetry profiling harness).
• Unblocks # [FEATURE/SAST] Implement Spatial Radar for Database Injection Funnels #105 and # [BUG/APPSEC] Spatially Verify Metaprogramming Hallucination Risk in Dev Agent Firewall #106.

Part of #102. Depends on #344 landing first (trusting sec_tainted_injection before building more on top of it).