[FEATURE/CORE-ENGINE] Persist a satellite-aware spatial ledger for post-hoc correlation (#346 phase 2) #348

🛑 Problem Statement

This is phase 2 of #346, split out to ship the safety-critical dampener-scoping fix (phase 1) independently and sooner, without also solving the larger problem below in the same PR.

detector.py's six existing _correlate_signals calls (now migrated onto the shared primitive and satellite-scoped for the three dampener pairs, in phase 1) still only operate on spatial_map — a dict local to a single coding_analysis() call, discarded the moment that function returns. Nothing outside detector.py can correlate against it.

That's a hard blocker for #105 and #106: both need to correlate signals from outside detector.py, at the post-hoc pipeline stage (dev_agent_firewall.py and the eventual db_hooks correlation both run over parsed_files in galaxyscope.py, well after coding_analysis()'s spatial_map is gone). threat_locations (rule_name -> [line_numbers]) does survive to that stage, but it's write-only today, has no notion of which satellite/function a hit belongs to, and security_lens.py's own already-computed line positions (e.g. for db_hooks) never get folded into it.

🎯 Objective

Make threat_locations (or its successor) the one persisted, satellite-aware spatial ledger usable by any pipeline stage, not just internal to detector.py.

🛠️ Proposed Implementation

• Extend threat_locations entries to carry owning-satellite/function id alongside line number, using the same satellite start/end data _calculate_block_metrics already computes.
• Fold security_lens.py's already-computed line positions (db_hooks, and any other Passive Security Lens Observer signal with position data) into the same ledger, instead of discarding them after producing a flat count.
• Migrate the three amplifier-only correlate() pairs (RCE/IO taint corroboration, active-secret-leak amplification, race-condition/cascading-flux amplification) onto satellite scoping too, now that the ledger and primitive are shared -- lower urgency than the phase-1 dampener fix (a false positive here just costs one extra review item), but should land before or alongside # [FEATURE/SAST] Implement Spatial Radar for Database Injection Funnels #105/# [BUG/APPSEC] Spatially Verify Metaprogramming Hallucination Risk in Dev Agent Firewall #106 so all six pairs are consistent.
• Expose a small read helper (e.g. correlate_against_ledger(file_data, source_keys, sink_keys, max_distance)) that post-hoc tools can call directly against parsed_files[i]["threat_locations"], so # [FEATURE/SAST] Implement Spatial Radar for Database Injection Funnels #105 and # [BUG/APPSEC] Spatially Verify Metaprogramming Hallucination Risk in Dev Agent Firewall #106 don't each hand-rope their own access pattern.

✅ Acceptance Criteria

• threat_locations (or its successor) carries owning-satellite id per hit, not just line number.
• security_lens.py's position data for at least db_hooks is merged into the shared ledger.
• The three amplifier-only correlate() pairs are migrated onto the shared, scope-aware primitive.
• Post-hoc tools (dev_agent_firewall.py, future ai_appsec_sensor.py work) can read the ledger without depending on anything internal to detector.py's coding_analysis() call.
• Unblocks # [FEATURE/SAST] Implement Spatial Radar for Database Injection Funnels #105 and # [BUG/APPSEC] Spatially Verify Metaprogramming Hallucination Risk in Dev Agent Firewall #106.

Part of #102. Depends on #346 phase 1 (dampener scoping) landing first.