fix(safety): exclude PDO method calls from exec() false-positive detection

[elhussienysabry]

Summary

Fixes #19

The PHP safety scanner was reporting false positives for legitimate PDO method calls like $pdo->exec() and PDO::exec(), flagging them as dynamic code execution findings.

Root Cause

The exec() danger pattern in _DANGEROUS_PATTERNS used a simple word-boundary regex:

(r"\bexec\s*\(", "exec() call — avoid dynamic code execution")

This matched any occurrence of exec( in a line — including PHP object method calls like $connection->exec($sql) — because it did not distinguish between the global function and method-call syntax.

Fix

Added negative lookbehinds for -> and :: operators so only standalone function invocations are flagged:

(r"(?<!->)(?<!::)\bexec\s*\(", "exec() call — avoid dynamic code execution")

Pattern	Before	After
exec('cmd')	⛔ flagged	⛔ flagged (correct)
exec(user_code)	⛔ flagged	⛔ flagged (correct)
$pdo->exec($sql)	❌ false positive	✅ allowed
$connection->exec($sql)	❌ false positive	✅ allowed
PDO::exec($stmt)	❌ false positive	✅ allowed

Changes

• semantic_code_intelligence/llm/safety.py — updated the exec() regex pattern
• semantic_code_intelligence/tests/test_phase12.py — added 6 regression tests

[elhussienysabry]

Closing to resubmit with correct author identity.