CI: install `tree-sitter` extra so AST scanner paths are measured by Codecov

Summary

.github/workflows/ci.yml installs the base agent-audit package without extras. Because tree-sitter, tree-sitter-python, tree-sitter-javascript, and tree-sitter-typescript are declared as optional dependencies under the tree-sitter extra, the tree-sitter-based AST paths in typescript_scanner.py (and any other scanner using TreeSitterParser) never execute in CI. Codecov therefore reports them as uncovered even when tests exercise the same fixtures.

This surfaced during the 0.19.2 release (commit 1009782), where the TypeScript eval() false-positive fix landed both an AST-based dot-boundary branch (typescript_scanner.py:387-407) and a regex-fallback branch. The regex branch is covered end-to-end by tests/test_typescript_scanner.py::TestEvalMemberCallDistinction (12 tests). The AST branch shows as fully missed on Codecov (contributing to the reported 35.71% patch coverage) because is_tree_sitter_available is False under poetry install.

Evidence

CI job runs poetry install without extras:

# .github/workflows/ci.yml:31-33
- name: Install dependencies
  working-directory: packages/audit
  run: poetry install

pyproject.toml declares tree-sitter as opt-in:

tree-sitter = {version = "^0.22.0", optional = true}
tree-sitter-python = {version = "^0.23.0", optional = true}
tree-sitter-javascript = {version = "^0.23.0", optional = true}
tree-sitter-typescript = {version = "^0.23.0", optional = true}

[tool.poetry.extras]
tree-sitter = ["tree-sitter", "tree-sitter-python", "tree-sitter-javascript", "tree-sitter-typescript"]

Local reproduction: with poetry install, typescript_scanner.py coverage is 66%, and the missing ranges (381-454, 459-520, etc.) correspond exactly to the tree-sitter code paths (_analyze_ts_call, _analyze_ts_literal).

Proposed fix

Change the install step in .github/workflows/ci.yml to install the tree-sitter extra:

- name: Install dependencies
  working-directory: packages/audit
  run: poetry install -E tree-sitter

(--all-extras is an alternative but currently pulls in the same extra; explicit -E tree-sitter documents intent.)

Expected effect: JavaScript AST paths become measurable immediately. TypeScript AST paths need a separate fix — see companion issue for the language-module API mismatch that keeps the TS AST path dead even after tree-sitter is installed.

User impact

None for PyPI users. Runtime behavior is unchanged; this is purely a CI measurement fix.

Target

0.20.0.