Scanner source boundaries

Resolves contained audit targets and enforces source discovery and file-reading limits.

This internal policy module controls supported files, exclusions, size limits, and coverage diagnostics so the audit stays inside its requested root.