Deepen tests (32->164) & demos (5->20), harden errors, fix 3 detection/UX bugs

[cognis-digital]

Summary

This PR roughly 4x's the depth of the repo with real work: it grows the test
suite from 32 -> 164 tests, the demo suite from 5 -> 20 narrated scenarios,
hardens error handling, and fixes three genuine detection/UX bugs -- all with the
public API unchanged.

Bug fixes

1. SSNs embedded in free text were not detected. The SSN detector used an
   anchored ^\s*\d{3}-\d{2}-\d{4}\s*$ regex, so it only matched when the SSN
   was the entire cell. An SSN buried in a clinical note ("... SSN 123-45-6789 to redact") escaped -- the exact free-text leak the tool claims to catch.
   Added a bounded search variant. The 3-2-4 dashed shape is distinct from phone
   numbers, so the search is false-positive safe.
2. Bare 3-digit numbers > 89 were mis-flagged as "age > 89" (S3). A value
   like 200 (a count, dosage, code, or a ZIP3 prefix such as 606) was flagged
   as a patient age. Constrained the age heuristic to a plausible human age
   (90..125; the oldest verified human age is 122), eliminating the false
   positives while still catching real ages >= 90.
3. --delimiter '\t' crashed with an uncaught TypeError. Passing the
   literal two-character token \t (a very common shell mistake) produced a
   traceback and a bare exit 1. The CLI now resolves \t/tab to a real tab,
   and analyze_csv validates the delimiter is a single character with a clear
   ValueError.

Error handling

• analyze_csv raises a clear ValueError on an empty file (no header row) and
  rejects non-single-character delimiters.
• The CLI validates -k/-l are positive, that -l is paired with
  --sensitive, and -- importantly -- that -k/-l are given
  --quasi-identifiers. Previously, gating on -k with no --qi silently
  PASSED, a dangerous false negative for a tool used as a CI gate. It now also
  catches IsADirectoryError/OSError and prints a readable message.

Tests (32 -> 164)

New focused suites: test_k_anonymity.py, test_l_diversity.py (incl. combined
sensitive tuples), test_safe_harbor.py (all 18 categories, value + header
detection, the new regression cases), test_malformed.py (empty/header-only/
ragged/BOM/unicode/duplicate-header datasets and error paths), test_cli.py
(every documented exit code + argument validation + output formats),
test_sarif_edge.py (rule catalog, DEID-K/L results, path normalization), and
test_analyze.py (pass/fail composition, smallest_classes). python -m pytest -q is green.

Demos (5 -> 20)

Fifteen new runnable, offline, exit-0 scenarios (see docs/DEMOS.md), plus new
synthetic fixtures under demos/11-14. demos/run_all.py runs all twenty end to
end under PYTHONUTF8=1.

All fixtures are synthetic. No real patient data anywhere in this repository.