fix(analyzer): filter license boilerplate from EA3 static findings (#312)

[rodboev]

Summary

Static-only scans currently report EA3 Scope Creep findings from Apache-2.0 boilerplate in LICENSE, COPYING, and NOTICE files. This change keeps those files in the scan inventory while filtering the filename-scoped EA3 false positive from the shared static-pattern runner.

Closes #312

Root cause

The static runner applies EA3 to every cached text-like component. Apache-2.0 contains the phrase not limited to, which matches EA3 even though license text is not skill instruction content. The default LLM path can discard these matches later, but --no-llm reports them directly and sends avoidable findings through the analysis pipeline.

Diff Notes

• Add delimiter-aware, case-insensitive LICENSE, COPYING, and NOTICE basename handling in static_runner.py.
• Filter only EA3 findings for matching text-like files at the shared finding gate.
• Preserve non-EA3 scanning, inspection-ledger completion, direct analyzer behavior, SKILL.md detection, and ordinary prose detection.
• Add production-path regressions for legal filename families, filename boundaries, ledger accounting, and direct EA3 behavior.

The filename-family scope follows the reproduction documented in issue 312, including the clarification that the false positive is exposed by --no-llm scans.

Scope

The filter applies to final text-like LICENSE, COPYING, and NOTICE basenames and only EA3. Other findings, non-license files, inventory, and report behavior remain unchanged.

Verification

• python -m pytest tests/nodes/analyzers/test_static_patterns.py tests/nodes/analyzers/test_binary_and_pe3_filtering.py tests/unit/test_patterns_new.py
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/
• skillspector scan --no-llm --format json