Guard value/alias matching against substring false positives in digit-run values

[bamdadd]

Context

disclosed() in src/context_leak/scoring.py matches attribute.value and each alias with a plain normalized substring test (needle in haystack). For digit-run values this over-matches: an alias 7429 is reported as disclosed inside the unrelated token 974290, and 47318.22 matches inside 447318.229. Because these are forbidden-flow hits, the effect is a false positive — a fabricated violation, which contradicts the 'a deterministic match never fabricates a violation' invariant in THREAT_MODEL.md.

Confirm phrases already use a bounded matcher (_phrase_present). The fix should apply an equivalent boundary to value/alias matching without introducing paraphrase or any model in the loop, and without stripping punctuation from the matched surface forms.

Acceptance criteria

• Value/alias matching no longer reports a hit when the surface form appears only as part of a longer alphanumeric token.
• Existing legitimate matches (value/alias surrounded by whitespace, punctuation, or string edges) still match; the club/observatory/theatre scenarios' expected results are unchanged.
• Normalization stays deterministic and documented; no LLM judge.
• Tests covering: a true digit-run match, the two false-positive cases above (now negatives), and a currency value bounded by $ and end-of-string.