fix: expand bandit --exclude paths into globs so nested files are pruned

[f0rodo]

Problem

The Security dimension was reporting 5,958 issues on a project that had .claude and .claude/worktrees in its exclude config. Inspection showed 5,932 of those were in .claude/worktrees/... — exactly the directories the user told desloppify to skip.

The exclusion is honored by the file-discovery layer (_find_source_files_cached correctly prunes via _is_excluded_dir). But the bandit_adapter calls bandit with the project root as its scan target and a --exclude value built from collect_exclude_dirs() — a list of bare absolute paths like /repo/.claude.

Bandit's --exclude is matched against the filenames it discovers during its own recursive walk: it filters files whose name equals one of the supplied strings. So /repo/.claude filters the directory entry itself, but /repo/.claude/worktrees/foo.py is still scanned (the full filename does not equal the exclude string).

Repro:

# Project with .claude/worktrees containing test files (assert-heavy)
$ bandit -r --exclude /repo/.claude /repo
# Returns thousands of B101 findings inside .claude/worktrees/

vs the form bandit's pattern matcher actually understands:

$ bandit -r --exclude '**/.claude/**' /repo
# Properly prunes the subtree

Fix

_exclude_globs(paths) (new helper in bandit_adapter.py) walks the path components of each input and emits **/<name> + **/<name>/** glob siblings alongside the original absolute path. The originals are kept as a belt-and-braces fallback; the globs are what actually do the work.

detect_with_bandit now passes _exclude_globs(exclude_dirs) to --exclude instead of the raw list.

Verified

End-to-end on a real project that excludes .claude and .claude/worktrees:

	Before	After
Security findings	5,958	3
In .claude/worktrees/...	5,932	0
Security score	8.9%	99.8%

Test

test_exclude_dirs_expanded_to_glob_for_nested_pruning asserts the emitted --exclude arg contains **/.claude, **/.claude/**, and **/worktrees/** when given /project/.claude and /project/.claude/worktrees as input.

5,533 existing tests still pass; the unrelated test_bundled_sync failure on scoring.md predates this branch.

Made with Cursor