fix(llm): isolate Stage 2 batch failures and keep unanalysed findings

[nyxst4ck]

Summary

Fixes the two coupled Stage 2 resilience bugs, which the reporter noted should be considered together because fixing the abort without fixing the drop would make the scanner less safe:

• Stage 2: one failed batch aborts the entire meta-analyzer pass and silently falls back to static #9 — one failed batch aborts the entire meta-analyzer pass and silently falls back to static
• Stage 2: apply_filter silently drops findings for files the LLM never analyzed (false negatives) #11 — apply_filter silently drops findings for files the LLM never analyzed (false negatives)

Changes

llm_analyzer_base.py — per-batch failure isolation. arun_batches now gathers with return_exceptions=True: a transient error (timeout, 429, oversized-chunk 400) is logged with the batch label and costs only its own batch instead of cancelling the whole fan-out. ValueError and NotImplementedError still propagate — they signal misconfiguration (missing API key, wrong response_schema), which skipping a batch cannot fix. This also benefits the two discovery analyzers (semantic_developer_intent, semantic_quality_policy), which previously lost all discovered findings when any single batch failed.

meta_analyzer.py — no verdict means conservative keep, not delete. With partial results possible, the keep/drop loop must distinguish "the LLM rejected this" from "the LLM never saw this". The node now partitions findings by whether a returned batch actually carried them (each Batch already tracks its findings): analysed findings go through the normal confirm-or-drop filter; unanalysed ones are kept via the existing _fallback_filtered path; a WARNING logs how many findings were kept unfiltered so the gap is visible rather than silent. When all batches fail, behaviour matches today's net result (everything kept via fallback).

Net effect, as suggested in #11: an infra failure can only ever cost enrichment on a file, never the finding itself.

Tests

• arun_batches: a failing batch doesn't abort the others; all-failed returns empty; ValueError still propagates (5 new tests in test_llm_analyzer_base.py).
• New tests/nodes/test_meta_analyzer.py: confirmed finding kept enriched + rejected finding dropped + unseen finding kept when one batch fails; all-batches-failed keeps everything; strict confirm-or-drop preserved when nothing fails.
• The two node-level tests are red on main and green with this fix.

pytest tests/ --ignore=tests/integration   # 598 passed; failures identical to main (pre-existing, unrelated)
ruff check / ruff format                   # clean on touched files

All commits are signed off per the DCO.