scan: run it against a real application tree and report the false positives

[arpanghoshal]

From docs/SPEC-scan.md §11, verbatim:

The false-positive rate is unmeasured against anything but this repository, where the first
run reported 208 findings and 216 undetermined calls across 44 files and two corrections took
those to 77 and 10. A library is not an agent, so even 77 is not a number to read as risk.
Until it is measured against real application trees, §4.5's sentence is doing the work.

This issue wants a number, not a patch. No code change is required and the deliverable is a
comment.

What to run

pip install ctrlrun
ctrlrun scan --path <your tree> --policy <your policy, if you have one>

An agent application, an internal service, anything with real call sites. Your own code or code
you may report on — do not paste anything confidential; counts and anonymised paths are the
whole point.

What to report

• Rough size of the tree: files, and what it does.
• Total findings, and how many were actually consequential in your judgement — a call you
  would want a human to answer for, or a policy entry to cover.
• How many were noise, and which verb produced each cluster.
• Anything genuinely consequential that scan missed. That is the more valuable half.
• Whether the report's own limits section matched what you found: scan misses dynamic dispatch,
  reachability, anything outside the tree, and a deployment protected entirely by the gateway
  (§4.4 reads as unprotected, which the report says).

A clean result is not a verdict and this issue is not asking you to treat it as one. It is
asking whether the default vocabulary is useful on code that is not this repository.

Related: #113 fixes the vocabulary once we know where it is wrong.