Add the two static checks the family audit found missing here

[jehrr]

Both come from an audit of all eighteen repos in this family, and both
catch a class nothing else in this suite can see.

First, §17's check #1: every call into a shared module is bound against
the callee's real signature. A sibling repo shipped
classify(html, url=...) in two of three engines against a callee whose
second parameter is status, and BOTH crashed on their first fetch --
invisible to import, --help, compileall, the undefined-name walk and
several hundred green assertions, because none of those calls a function
the way a live run does. The check also fails on a call to a name the
shared module does not define: bbb-scraper resolved the callee with
getattr(..., None) and skipped whatever came back not-callable, so three
calls into an API that did not exist sat under a green run of its own
binding check.

It is conservative by construction. A call using *args or **kwargs is
skipped rather than guessed at, and a name bound anywhere in the calling
file shadows a same-named module -- an engine takes proxy_pool as a
PARAMETER, and proxy_pool.next() on that parameter is a method call, not
a module attribute. Without that rule the check reports false positives
on a clean repo. It also asserts that it found calls to bind at all, so
it cannot pass by scanning nothing.

Second: no statement the control flow can never reach -- anything after
a return/raise/break/continue in the same block. The undefined-name walk
beside it cannot catch this, and correctly so: it pools every binding in
the file rather than tracking scopes, so a name used in dead code
resolves against a real parameter elsewhere in the module. Six repos in
this family carried the same fifteen unreachable lines, byte for byte,
from their first commit -- a function whose def line had been lost,
its body absorbed into the end of the function above. This repo's
current tree is clean; the check is what keeps it clean.

Run against this tree before being added: both clean, no findings. Both
verified by control -- return 1 followed by a statement, and a
finish_run() call with fourteen positional arguments, each turn the
suite red, and removing them turns it green.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code