fix(routes): a document or log path is not an HTTP route literal

[DeusData]

Distilled from #1245 by @ahundt (a slice of 0370d52), carried with Co-authored-by. #1245 stays open until its distills land.

The bug

detect_url_in_args runs for every resolved call with no callee gating. "/new/file.txt" clears normalize_url_arg (second slash, no whitespace) and reaches the route-literal check, whose filesystem-extension list knew about config, key and socket files but not documents or logs. So open_file("/new/file.txt") minted a Route node and an HTTP_CALLS edge — the graph reported a web endpoint where the program opens a file.

The fix

Five extensions join hard_file_exts: .log .md .pdf .rst .txt. Alphabetical order preserved; formatted with a range-limited clang-format, not a whole-file run.

Why the fixture looks the way it does

The obvious test would not have been RED, and the worker caught both reasons:

• A bare Python builtin open(...) never resolves to an indexed target, so it never reaches the URL detector — the bug only shows for calls that resolve to a project symbol. The fixture defines open_file/read_file/write_file.
• /var/... is already rejected by the filesystem root list, so the fixture uses /data/app.log and paths whose first segment that list does not know — leaving the extension guard as the only thing that can reject them.

RED → GREEN

Before:

infrascan_http_route_literal_guard_rejects_document_extensions
    FAIL tests/test_infrascan.c:44: ASSERT(!(cbm_service_pattern_is_http_route_literal("/new/file.txt", "open")))
pipeline_arg_url_rejects_document_file_paths
    FAIL tests/test_pipeline.c:6652: count_nodes_named(s, project, "/new/file.txt") == 1, expected 0 == 0

The pipeline test keeps a positive control above that line — a real requests.get("/api/items") still yields its Route and HTTP_CALLS edge — so the guard cannot pass by rejecting everything.

After: infrascan 4 passed · pipeline 282 passed · extraction edge_types_probe route_canon 420 passed.

Not taken from the same upstream function: its whitespace and first-segment-colon guards — separate defects, separate PRs.