fix(plugin): preserve Go declarations after raw strings ending in backslashes

[LittleYier]

Summary

Go raw strings treat backslashes literally. The rank-preview masker previously treated a backslash as an escape, so a raw string ending in an odd number of backslashes could hide later functions and methods. This valid declaration reproduces the problem:

const Root = `C:\`

Changes

Route Go backtick strings through the existing raw-string terminator handling. Add a regression test confirming declarations before and after a raw string ending in one backslash appear in the preview.

Testing

• python -m pytest plugins/codex-security/tests/test_rank_preview.py -q — 88 passed, including the merged PHP heredoc regressions.
• python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security — passed.
• python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security — passed.
• pnpm --dir sdk/typescript run build:ci — passed.
• node .github/scripts/check_plugin_source_compatibility.mjs — passed.
• NODE_NO_WARNINGS=1 node --test .github/scripts/test_check_plugin_source_compatibility.mjs — 9 passed. Unrelated local runtime warning output was disabled for the checker's exact-stderr assertions.
• Nine synthetic Go fixtures compiled with Go 1.26.3; base/head preview comparisons covered zero through four trailing backslashes, multiline raw strings, same-line braces, comments, interpreted strings, runes, and struct tags.
• JavaScript, Rust, PHP, and C# masker comparison probes were unchanged.

Risk and rollout

Five implementation lines reuse existing raw-string handling and apply only to Go backtick strings. No public CLI or configuration changes. Refreshed on current main and verified together with the PHP heredoc fix.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[mldangelo-oai]

Thanks for the focused fix! I reproduced the missing later declaration on current main and confirmed the PR restores it for valid Go raw strings. Reusing the existing raw-string terminator is a simple and appropriate solution.

I checked trailing-backslash parity, multiline strings, same-line braces, comments, interpreted strings, runes, and struct tags, and verified the refreshed branch preserves the PHP heredoc fix. The 88 preview tests and required portable source checks pass; two independent reviews found no code changes needed. I also clarified the reproducing example and validation details in the description.

Approving the refreshed revision. Merge remains subject to the required CI checks.