fix(tm1): use the final repeated assignment target

[chrisknvidia]

A repeated boolean target such as enabled, enabled = True, False leaves enabled false, but TM1 retains the earlier true value and reports HIGH on a subsequent shell=enabled call.

Use Python's left-to-right assignment order to identify the final value. Suppress earlier affirmative stores only when the final value is provably false, the entire RHS is passive, and prior target bindings are proven safe in a supported straight-line module or function scope. Unknown values/effects, identity assignments, class scopes and unsupported contexts preserve the conservative event policy. Imports add safety only for their own freshly proven native binding.

Regression coverage includes tuple/list targets, nested unpacking, chained assignments, false/true finals, identity/unknown finals, and prior-binding/import controls. This is a narrow false-positive fix; uncertain preceding operations can retain existing false positives.

Validation of the unchanged detector/test bytes:

• 461 focused tests passed with plugin autoload and unrelated package discovery disabled; this is focused unit evidence. Ruff and diff checks passed.
• Independent RG checked 305 final-source cases and eight cap/deadline/stress checks. Separate manual code/security passes found no remaining actionable issue.
• Installed baseline/fixed Linux wheels passed 30 baseline and 92 fixed JSON/SARIF scans, including source positions, completeness, report options and baselines. Eleven control identities matched main; two fresh standalone console scans passed. Source/wheel/installed analyzer bytes and 70 dependency versions matched.
• The preceding integration head 53c40020 passed all six hosted CI checks, including 13,001 unit tests. Earlier macOS startup timeouts remain separate from the successful Linux evidence.

Automatic main updates changed CLI preflight and report-provider metadata while leaving this PR's complete feature diff unchanged. Current integration head f8ac51bb restarts CI without changing source; earlier green checks do not clear this new head. Current CI remains pending. All scan fixtures are synthetic and use --no-llm; model-enabled and hosted-consumer execution remain unverified. Native Bugbot and Security Review passes are unavailable and have not been claimed; the PR remains draft pending the outstanding review requirements. No merge or auto-merge is enabled.