Audit contract

checkout root is /tmp/ossscanner/clone; finding.file is relative to it
mounted stores: ../../../root/llmproxy/.env, ../../../etc/passwd, ../../../var/www/fastuser_2/data/www/llmproxy.org/api/config.php, ../../../../etc/passwd, ../../etc/passwd, a/../../../etc/passwd
one finding per store, file is the store path verbatim (../ kept)
committed symlinks to host files are critical findings: file=src/env.js or src/path_link.js
ground truth: tests/fixtures/expected-findings.json