fix(analyzer): make E2 whitespace-tolerant and detect all os.environ read forms

[weed33834]

Summary

The E2 (Env Variable Harvesting) regex patterns are spell-checkers, not behavior detectors. os\.environ without optional whitespace between os and . means that inserting PEP8-irrelevant whitespace — os . environ . copy () — bypasses detection entirely. A skill scoring DO_NOT_INSTALL with canonical syntax can be rewritten to SAFE by adding spaces. The same blind spot lets dict(os.environ) and {**os.environ} pass clean, even though they do exactly what the rule is meant to catch.

Changes

1. Whitespace-tolerant os.environ matching — \s* between os and \. in all Python E2 patterns, so whitespace variants no longer bypass detection.

2. New patterns — dict(os.environ) and {**os.environ} (the two most common alternative forms of reading the full environment mapping) are now detected.

3. 5 regression tests added to test_patterns.py.

Testing

$ python -m pytest tests/unit/test_patterns.py tests/nodes/analyzers/test_static_patterns.py -v
157 passed in 2.07s

$ make lint && make format
All checks passed!
157 files left unchanged

Fixes #329

[rng1995]

[Automated SkillSpector Review]

Approved. The E2 additions cover whitespace-obfuscated os.environ access plus full-environment reads through dict() and mapping unpacking without changing the rule schema. Focused E2 regressions passed (7 tests), as did Ruff lint and format checks.

[rng1995]

Blocking: broadening the prior mapping-literal regex to bare ** makes the malformed-Python fallback flag exponentiation. On this exact head, result = 2 ** os.environ plus a syntax error elsewhere produces an E2 finding on line 2, even though the existing valid-Python negative test correctly treats this expression as non-harvesting. Keep mapping-unpack boundaries or otherwise distinguish unpacking from exponentiation, and add a fallback-path regression.

[rng1995]

[Automated SkillSpector Review]

Re-review: requesting changes on the new head. The 19 focused E2 tests and Ruff lint pass, but the conflict-resolution commit broadens the malformed-Python fallback from mapping unpacking to bare ** os.environ. Exact-head verification shows 2 ** os.environ is then reported as E2 when another syntax error triggers fallback. Restore unpacking boundaries or equivalent parsing and cover the malformed negative case. GitHub also reports merge conflicts.