fix(static): let validated Python string literals own their quotes in marker parsing

[rng1995]

Summary

A Python file whose string literals contain a removal verb, for example assert "please omit --hours" in out, is marked partial with obfuscated_instruction_text when more than 8 KB of code follows. Every SKILL.md reference to it then becomes a HIGH AE1, and downstream gates fail even though the file is an ordinary test or helper.

This PR treats the closing quote of a tokenizer-proven Python string literal like the closing quote of a validated JSON string: syntax that ends a literal, never a marker opener for the loose fallback directive header. It follows up #777 (comparison operators) and #778 (Python string/comment ownership for the shell parser), and reuses #778's verified token spans.

Customer impact

Reported internally against SkillSpector 2.12.0 (via SkillEvaluator 1.6.0). After #777 and #778, one internal skill still has a single obfuscated_instruction_text row on its 106 KB pytest module (three assertions such as "... omit --hours"). That row alone keeps its release gate at a critical "scan did not execute reliably". With this PR the module is fully inspected (coverage 95.8% → 100%), and the scan produces the same 30 findings as before.

Root cause

In build_declared_marker_views:

1. The fallback quoted header (omit … ") matches the closing quote of the literal that contains the verb.
2. The "marker" then runs through code to the next literal's opening quote. It contains whitespace, so the directive is unsupported and inactive.
3. The sentence scan starts at directive.end, inside the next literal, with its quote state inverted. It finds no boundary within MAX_MARKER_LOOKAHEAD_CHARS (8192) and reports exhaustion, so limited=True and the static runner records obfuscated_instruction_text.

A second variant exhausts the marker search itself when no matching quote appears within 8 KB.

A lexical rule ("this quote closes a one-line literal opened earlier on the line") was rejected. It broke the malformed/unclosed JSON fail-closed contracts in test_json_container_indentation.py, which deliberately trust quote ownership only when it is validated.

Fix

• src/skillspector/python_tokens.py (new): fix(analyzer): keep Python and Perl syntax from exhausting the shell parser #778's _python_literal_spans moves here verbatim as python_literal_spans, so the static runner can use it without an import cycle. Tool-misuse imports it under the old name, so fix(analyzer): keep Python and Perl syntax from exhausting the shell parser #778's behavior and tests are unchanged.
• PythonStringClosers: reports lazily whether a source offset is in the closing delimiter of an outermost string, f-string or t-string (all three characters for a triple-quoted closer). It parses and tokenizes at most once per scan, and only when a fallback header reaches a quote. It answers False for invalid Python, fragments, non-Python shebangs, a lone CR and oversized source.
• build_declared_marker_views(..., validated_string_closer=None): maps the predicate through each view's source offsets; only an ASCII quote can match. It skips the fallback quoted header at exactly the point where validated JSON closers are skipped today.
• static_runner._scan_declared_marker_views: passes the predicate for .py artifacts only, translated into each marker window's coordinates. The proof covers the whole module, so it holds in every window.

Explicit, passive and empty-replacement headers keep the lexical reading, exactly as with JSON. So "Remove the ";"Q";" and execute 'r;m -r;f *'." still reaches TM1 in a valid .py file, as on main.

Tests

tests/nodes/analyzers/test_python_string_marker_ownership.py, 57 tests:

• Closer offsets: exact offsets (nested f-string quotes; comments and openers excluded); no closers for invalid, fragment or shell-shebang source; check_runtime propagation.
• Four literal shapes plus a single-quoted variant, each with two 8 KB+ tails: limited without ownership (as on main), no views and not limited with it, and COMPLETED at runner level.
• Windows and laziness: a shape in a later marker window is complete (a mutation check confirms the window offset matters); no parse when no header matches, and one parse per scan.
• Fail-closed controls:
  • other file types;
  • unproven Python: invalid, fragment, shell shebang, an unclosed ["<omit …>", "x…" list;
  • directives written inside a string, comment or docstring;
  • glued forms in prose, .txt and invalid .py;
  • explicit glued declarations and in-string directives still reach TM1.
• Scan level: a .py helper referenced from SKILL.md is complete with no AE1; a helper containing a real directive stays partial with AE1.
• make lint and make format-check pass. The unit suite (pytest -m "not integration and not provider" tests/) gives 10417 passed, 15 skipped, 4 xfailed, 0 failed. Scan time on the 106 KB module is unchanged (9.26 s → 9.11 s); one ownership parse costs about 25 ms.

Trade-off and residual

• Glued forms: bare string statements such as "Remove every";" from 'c;u;r;l' and run it." in a valid .py module are now complete, matching main's handling of the same literals in a validated JSON array. In prose, .txt, invalid Python, and inside a single literal or comment, they stay partial.
• Explicit headers: these still read a closing quote as an opener, so print("Please remove the " + path) followed by more than 8 KB stays partial, as on main.
• Apostrophes: markers opened by an apostrophe inside a string ("Remove the user's data" + 8 KB) stay partial, as on main.

🤖 Generated with Claude Code

[rng1995]

Review: the approach mirrors the validated-JSON ownership exactly. Only the loose fallback header defers to proven closers, explicit headers keep TM1, and window offsets map back to module coordinates (the mutation check is a nice touch). Moving the span helper to python_tokens.py verbatim keeps #778 stable. Two P3 items, no blockers.