fix(analyzer): detect full environment reads via AST

[mohgupta-ship-it]

Summary

Replaces the spelling-sensitive Python E2 full-environment checks with AST-based detection.

• Detects complete environment materialization or enumeration through copy(), dict(os.environ), dict unpacking, .items(), direct iteration, and copy.copy() variants.
• Resolves os / environ import aliases and remains insensitive to formatting such as os . environ . copy ().
• Preserves non-Python checks and a regex fallback for syntactically invalid Python.
• Does not treat a single-key read or passing os.environ to a child process as environment harvesting.

Root cause

E2 matched literal text such as os.environ.copy(); semantically equivalent syntax and import aliases bypassed the rule. This AST-based implementation covers the full reproduction set from the issue without broad argument-matching false positives.

Validation

• uv run --no-sync python -m pytest tests/nodes/analyzers/test_static_patterns.py tests/unit/test_patterns.py -q
• uv run --with hatchling --no-sync python -m pytest -qq --disable-warnings -m "not integration and not provider" tests/
• uv run --no-sync make lint
• uv run --no-sync make format-check

This is a broader AST-based alternative to the regex-only coverage in #331.

Fixes #329

Created by Codex on behalf of Mohit.