Carrylint misflags CLI list dependencies, adds use‑mention rule

A patch release of the carrylint linter inverted its CLI‑dependency rule, causing declared list‑style dependencies to be reported as missing [Dev.to].

The original rule required a requires: key with a scalar value, e.g. requires: codex. When authors used a YAML list—the idiomatic form for multiple dependencies—the rule ignored the block and warned that codex was undeclared. The same logic later mis‑flagged policy statements such as "never run git push" because the detector matched the string without checking whether it appeared in code or prose.

Running the linter over 586 public skill files produced a 0.7 % fire rate, and every hit was a true positive. Targeted adversarial testing, however, exposed the false‑positive cases described above.

The fix introduces a structural distinction: only commands inside backticks or fenced code blocks count as executions, and lines containing negation or conditional language are excluded. The regex for remote‑copy detection (\b(?:scp|rsync)\b[^\n]*\s\S+@\S+:) was rewritten to avoid quadratic backtracking on long lines, cutting worst‑case runtime from 312 ms at 40 k characters to under 5 ms [Dev.to]. Re‑running the corpus after the changes left the fire rate unchanged at 0.7 % while eliminating the spurious warnings.

Why it matters: false positives erode trust, prompting users to disable rules and weakening overall safety; the bug disproportionately affected files that already contain policy language, biasing results toward careful authors; and adversarial testing revealed blind spots that a pure real‑data audit missed, underscoring the need for both corpus and edge‑case validation in static‑analysis tools.