[Feature Request] Add legitimate coding pattern recognition to reduce false positive security flags

**Bug Description**
flag legitimate coding (reading code for a TUI app) as [cyber]

**Environment Info**
- Platform: darwin
- Terminal: ghostty
- Version: 2.1.235
- Feedback ID: 85a51485-8be9-4fa8-b035-3e0f4c93f13f

**Errors**
```json
[]
```

The issue names no implementation files, tests, or entry points. Start by reproducing the false positive while reading code for a TUI app on Darwin with Ghostty, using feedback ID 85a51485-8be9-4fa8-b035-3e0f4c93f13a. Done means legitimate coding activity is no longer flagged as cyber while the intended security detection remains effective.

Written by the indexing model from the issue text.