fix(friction): reduce regex scan noise with denylist and aggregation (#473)

[solomonneas]

Summary

• Configurable source denylist for static caches, skill trees, and ambient-suggestion payloads (defaults plus optional .brigade/friction/config.json).
• Prose damping: markdown outside .brigade/work and .brigade/runs keeps keyword hits but severity is forced to low.
• Identical regex snippets collapse into one candidate with evidence.occurrence_count and evidence.source_paths.

Closes #473.

Test plan

• ./scripts/verify (local)
• pytest tests/test_friction_cmd.py tests/test_repos_friction_cmd.py -q
• Coverage: prose-damped SKILL.md, 5-file identical warn aggregation, denylisted model-cache.json, custom denylist config

Review notes

Independent review found no Critical issues. Known tradeoffs accepted for this slice:

• Damped markdown still consumes candidate quota (severity is low; triage by severity).
• Config deny_names / deny_globs replace defaults when set (explicit override).
• Regex candidate ids now key on type+snippet (enables cross-file aggregation; may re-fingerprint imports).

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 96ca9a45-ba17-406e-be0c-6c799f799d7e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue/473-friction-scan-noise

---

_{Comment @coderabbitai help to get the list of available commands.}