fix(analyzer): stop EA1 from matching multiline gaps and markdown bold spans

[AmirF194]

Fixes #405.

Root cause

EA1_PATTERNS[0] in static_patterns_excessive_agency.py is
(?:tools?|permissions?)\s*:\s*\[?\s*['"]?\*['"]?\s*\]?. Python's \s matches
newlines regardless of re.MULTILINE, so the gap the pattern allows between the
colon and the wildcard value is unbounded across blank lines and paragraphs, and
the pattern has no check that the matched * is a standalone token rather than the
first * of a **bold** span. Two shapes both produce a false-positive EA1
finding on prose that grants no tool access: a blank-line gap (tool:\n\n**Input Schema:**) and a markdown bold heading (**API Coverage vs. Workflow Tools:**).

Fix

Replace the pattern with (?:tools?|permissions?)\s*:[ \t]*\[?[ \t]*['"]?\*(?!\*|\w)['"]?[ \t]*\]?:
restricts the gap to spaces/tabs (no longer crosses a blank line) and adds a
negative lookahead so the matched * cannot be followed by another * or a word
character, so it can no longer be the first character of a bold span or an
identifier. The three real wildcard-grant shapes (tools: "*", tools: [*],
permissions: '*') still match.

Verification

• New regression tests in tests/nodes/analyzers/test_static_patterns.py: the two
  false-positive shapes from the issue no longer produce an EA1 finding, and the
  three real wildcard shapes still produce EA1 at MEDIUM severity.
• make lint and make format-check clean.
• Full unit suite in a clean python:3.12-slim container: 2800 passed (2795
  existing + 5 new), 14 skipped, 4 xfailed, matching the repo's test-unit gate.
  Under --cov (the test-ci recipe), two unrelated tests in
  test_security_end_to_end.py fail; reproduced the same two failures 3/3 runs
  against unmodified main under the same --cov flag, so this is a pre-existing
  flake independent of this change, not a regression it introduces.
• docker-smoke (image build plus tests/docker/smoke.sh) passes.