fix(analyzers): rely on runner for example filtering in E5 and TM4 (close executable bypass)

[CharmingGroot]

Summary

The SC7 review (#224) established that calling is_code_example() inside an analyzer with an unconditional continue lets a nearby example marker suppress findings in executable files — the shared runner already filters examples in non-executable docs and only downweights executables, so the analyzer-level call is redundant and opens an attacker-controlled bypass. E5 (#218) and TM4 (#220), both merged, use the same pattern. This applies the same fix.

Changes

• static_patterns_data_exfiltration.py (E5): drop the is_code_example call and import; rely on the runner's file-type-aware handling.
• static_patterns_tool_misuse.py (TM4): same.
• Tests: TM4's analyze-level doc-exclusion test is replaced with an executable-evasion test (# for example next to privileged: true still fires); an equivalent E5 regression is added.

Why this is safe

Detection is unchanged — the runner still suppresses non-executable docs and downweights executables. Only the bypass is closed: a # for example near s3.put_object(...) or privileged: true in a .sh/.py no longer evades E5/TM4. anti_refusal already uses a confidence penalty (not a skip), so it is intentionally left as-is.

Testing

make format and make lint pass; the full suite reports 1256 passed, 0 failed. A re-scan confirms detection is preserved (E5 ×2, TM4 ×6 still fire on the same fixtures).

Follows up on the review in #224.