fix(pipeline): reject non-HTTP slash arguments

[Yyunozor]

Summary

• apply the existing HTTP route-literal guard before creating arg_url routes
• reject raw slash expressions such as JS regex literals
• reject slash strings passed to non-HTTP string and regex consumers
• add focused regressions for filesystem paths and a genuine API path

Root cause

detect_url_in_args() normalized every slash-prefixed call argument and
created a Route node directly. That path bypassed the shared route-literal
guard already used by the later route-node pass, so local filesystem paths and
regex operands could become Route nodes and HTTP_CALLS edges.

The change first rejects slash-prefixed raw expressions (string literals and
propagated constants are carried separately), routes the remaining heuristic
through the shared guard, and extends the callee filter to non-HTTP string
consumers such as replace, match, search, test, and exec.

Validation

• scripts/test.sh --suites 'infrascan pipeline' — 241 passed
• the same tests on the parent fail on sink(/<table/i) and
  template.replace('/html/g', ...)
• full suite — 6821 passed, 3 failed, 4 skipped
• the parent reproduces the same failures: cli (255 passed, 2 failed) and
  daemon_runtime (42 passed, 1 failed)

This addresses the arg_url regex/path bucket of #598. GraphQL and
whole-config-text classification remain out of scope.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for narrowing the route heuristic to HTTP-shaped slash arguments and for adding focused extraction coverage. This is now routed as a high-priority parsing fix in 0.9.1-rc. This note is an intake acknowledgement rather than a code review; the queue is currently full, so validating false-positive and false-negative behavior across frameworks may take a little time.