[philipgreat]

Part of #10. This PR addresses generated-workspace discovery and false-negative/false-positive behavior for the existing expression policy commands. It does not claim W4 public release or W5 delivery adoption.

Changes

• Keep generated Python/.NET/TypeScript/Swift scaffolding out of application-owned findings only when generated-facade markers are present.
• Discover the matching sibling generated library without searching unrelated ancestor directories.
• Recognize qualified generated E facades and C# inline namespaces correctly.
• Refresh locked rustls to 0.23.46 and quinn-proto to 0.11.18 after cargo-audit exposed nine vulnerabilities in the old lock.

Verification at current head 0a022a1

• cargo test --locked: 53 passed, 0 failed.
• cargo clippy --locked --all-targets -- -D warnings: passed.
• cargo audit: 0 vulnerabilities; two non-blocking warnings remain (unmaintained unsafe-libyaml, yanked chacha20).
• Conformance W2: eight clean and eight violating generated-workspace command outcomes; generated trees unchanged.
• Conformance W3: exact internal candidate cargo-teaql 2.0.15-w3.0a022a17 from this head; isolated Registry install and W1/W2 replay twice, 64/64 expected outcomes. Latest retained evidence is teaql-conformance evidence/2026-10-17-workspace-expression-policy-w3-gate-3/.

Native application compilation, public package provenance and delivery-CI wiring remain separate gates.