fix(api-inventory): preserve dataclass constructor semantics in static module scan

[seonghobae]

Finding

The static public-API inventory repair on #1717 correctly stopped executing discovered module names, but its AST dataclass projection no longer matches the runtime constructor contract that the inventory is supposed to describe.

Current #1717 head before this repair: 4493f58ac02ba16e08e2d8dc6b0e2ef2b2407db8.

tools/inventory_public_api.py::_ast_class_params() currently treats every public annotated dataclass field as a constructor parameter and drops every underscore-prefixed field. That is not how dataclass-generated __init__ works:

• field(init=False) is not a constructor parameter even when the field name is public;
• InitVar participates in the generated constructor, including an underscore-prefixed InitVar;
• ClassVar does not participate in the generated constructor.

A concrete repository-owned regression is fast_mlsirm.scoring.rag.RAGPerturbationAnchor. Its canonical runtime-derived inventory row in docs/api/inventory-20260917.csv is:

anchor_id, baseline_request_fingerprint, perturbed_request_fingerprint, perturbation_specification_fingerprint, perturbation_run_fingerprint, perturbation_kind, _anchor_token=None

The source class also has public derived fields expected_construct, expected_direction, and construct_basis declared with field(init=False). The current static projection would include those three false constructor parameters and omit _anchor_token, changing the governed API inventory solely because the scanner implementation changed.

Required repair

Keep repository module discovery static. Do not restore importlib.import_module(modname), suppress Semgrep, or weaken SAST policy.

Acceptance:

• add a public regression against the real RAGPerturbationAnchor source;
• static dataclass projection excludes field(init=False) and ClassVar fields;
• it includes actual constructor InitVar fields even when their names begin with _;
• existing default/default_factory rendering remains intact;
• exact-head inventory/CI/SAST evidence is reacquired after the causal fix.

This is API-governance tooling, not psychometric arithmetic; no scientific estimator behavior should change.

[seonghobae]

Ordinary-forward repair is now on #1717:

• public RED 7b5b4a584a65f97b2f9faf4fd85f32af37548f22 pins the real RAGPerturbationAnchor constructor contract;
• causal production repair 4ab8a2bfede1c9478f3f009c3b395ff0fb715d11 excludes ClassVar and literal field(init=False) from static generated-constructor projection while retaining underscore-prefixed constructor InitVar fields;
• edge contract d42801c4ca599d318982fde8b8f230ccea62c858 additionally covers ClassVar, field(init=False), default_factory, and underscore-prefixed InitVar together.

Discovered module imports were not restored and no Semgrep suppression/gate change was added. Current-head #1717 CI/CodeQL/Security/Semgrep/fuzz runs have been created but are still queued/pending, so this issue remains open until exact-head hosted evidence confirms the repair.