Fix EG308 false positives and validate issue #87 against interview corpus

[nonprofittechy]

Fix

Closes #87.

EG308 now finds actual Python reads using the AST. A variable mentioned only in
a comment, string literal, or assignment target no longer triggers an unmatched
guard error. Attribute and subscript expressions, f-string interpolation, and
augmented assignments remain covered. Findings point to the first unguarded
read, and subscript matching tolerates quote and whitespace differences.

The proposed EG416 suppression is intentionally not included. Upstream
docassemble's attachment parser
does not consume attachment-level if: or hide if: keys. Those keys do not
ensure that content is conditionally generated, so suppressing EG416 would hide
a potential runtime error. Regression tests retain the warning for these cases.
Existing Mako guard and skip undefined handling is unchanged.

Validation

• pytest -q tests: 391 passed, 54 subtests passed, including 54 new regression cases.
• mypy src tests --explicit-package-bases: passed (21 source files).
• Black check on changed files and git diff --check: passed.
• Ran the CLI before and after against /home/quinten/all_interviews:
  .venv/bin/python -m dayamlchecker /home/quinten/all_interviews --no-url-check.
  This covered 180 YAML files across 54 repositories, with default related
  DOCX and Python-module checks. URL checks were disabled to exclude network
  variability. The corpus was not modified.

Findings	Before	After
Errors	203	197
Warnings	484	484
Information	307	307
Total	994	988

No regressions observed: all changes were expected EG308 corrections.
Inspected all six removed findings: five were assignment targets supplying
defaults in MA209AProtectiveOrder, and one was a commented-out reference.
Four retained findings now point to actual reads rather than earlier assignment
targets (CLACareTypeFinder: 174→177, 175→181, 396→398;
MA209AProtectiveOrder/209A_page_1.yml: 859→862). Every other finding and stderr
were unchanged. Both corpus runs exited 1 because of existing corpus errors.

Unrestricted pytest discovery also picked up an unrelated, ignored ALWeaver
checkout under workdir/ that requires unavailable docassemble dependencies;
the complete DAYamlChecker suite was run explicitly from tests/.