fix: security (bandit) detector ignores config-level excludes

[Loreweavr]

Problem

desloppify exclude <dir> is honoured by the file-discovery detectors (duplication, orphaned, unused, …) but not by the Python security / bandit detector — it keeps reporting findings from excluded directories (e.g. a vendored library you don't own).

Minimal repro:

mkdir -p proj/vendor
printf 'import subprocess\nsubprocess.Popen("x", shell=True)\n' > proj/vendor/bad.py
printf 'x = 1\n' > proj/app.py
cd proj
desloppify exclude vendor
desloppify scan --path .
desloppify show security --status open   # vendor/bad.py is STILL reported

Root cause

detect_python_security (languages/python/_security.py) builds bandit's --exclude list from collect_exclude_dirs(scan_root). That uses get_exclusions(runtime=None), which resolves to a runtime context whose .exclusions is empty here — so only the built-in DEFAULT_EXCLUSIONS (.git, node_modules, …) reach bandit. The persisted config excludes (config["exclude"], what desloppify exclude writes) are never threaded in, so bandit -r recursively rescans them.

The bandit adapter already supports --exclude correctly — the excludes simply never arrive.

Fix

Load the config excludes in detect_python_security and pass them through collect_exclude_dirs(extra_exclusions=…) alongside get_exclusions().

Tests

There was no bandit exclude-flag test (only ruff ones), which is how this slipped through. Adds TestBanditSecurityExcludeFlag to tests/detectors/test_external_adapters_exclude_flags.py. Confirmed it fails without the fix (the exclude list contains only the defaults) and passes with it. Full languages/python/ + detectors/security/ suites: 379 passed.

Environment where observed: Windows, Python 3.13, bandit 1.9.4.

🤖 Generated with Claude Code