feat(scanner): add unchecked return value detection plugin

[aristocratte]

Description

Adds a lexical detector for low-level Solidity calls whose success result is discarded or lacks a recognized immediate check. Handles call, send, delegatecall, and staticcall, including call options and legacy .value().gas() syntax. Findings include source locations and a require(success) recommendation.

AI disclosure: This implementation, tests, and review were performed by Codex. No meaningful human code contribution or human review is claimed. I understand the bounty excludes fully AI-generated submissions; this draft is submitted transparently for consideration, not as an eligible bounty claim. Please close it if AI-generated drafts are also outside your contribution policy.

The plugin uses the existing registry API, verified in an integration test. It does not add a concrete plugin dependency to scanner-core, following the current CONTRIBUTING.md and docs/plugins.md. This differs from issue #16's requested registry-file modification, and the plugin is not enabled automatically in the API.

address.transfer() is excluded because it reverts on failure rather than returning a success flag.

Limits

This is a heuristic detector (confidence 0.7), not type or control-flow analysis. It may flag user-defined methods with the same names, delayed checks, complex boolean checks, and checks delegated to helper functions. It does not track aliases or analyze Yul. Recognized direct returns propagate the result to the caller rather than checking it locally.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Performance improvement
• Refactoring

How Has This Been Tested?

On macOS with Node 26.7.0 and pnpm 9.1.0:

• 69 plugin tests pass, including registry integration. Coverage: 99.02% statements/lines, 92.03% branches, 100% functions; all thresholds set to 80%.
• All 5 existing scanner-core tests pass.
• Plugin build, typecheck, and lint pass.
• Repository lint and formatting pass.
• Frozen lockfile installation with --ignore-scripts passes. Prisma generation was run separately and passed.
• Global build, typecheck, and test commands are blocked by TS2322 at packages/ai-engine/src/diff-generator.service.ts:254 (string | number assigned to number). The same build error reproduces in an untouched worktree at base commit 0b5b153ccbaa10b43f7750685e0f18e0d6a320fd with its original lockfile. No unrelated fix is included.

The Solidity snippets are static-analysis fixtures, not compiled or deployed contracts. Node 20 CI has not been verified locally.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have added tests that prove my fix/feature works
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• New and existing tests pass locally

The self-review box is left unchecked because review was agent-performed. The full-test box is left unchecked because the repository-wide test command cannot finish past the existing build error. Vite emits an existing CJS API deprecation warning during focused tests.

Related Issues

Related to #16. This draft does not claim to fully satisfy the bounty's eligibility or integration requirements.