[yashrajp22]

An imported setup function can replace a harmless output function with a shell executor. The release branch currently skips that imported function body, allowing the scan to report SAFE with complete analysis when it should retain CAUTION and incomplete analysis.

This change follows imported names used during module initialization, including aliases, callbacks, defaults and decorators. It reuses the existing bounded import analysis and preserves harmless setup, unused imports and selected safe helpers beside unrelated functions.

This PR targets the v2.13.1 release branch because the affected import checks were added there while integrating #849. It is a separate correction for #852 and should remain unmerged until release inclusion is requested.

Known precision limit: reading a value from a module with unrelated shell-capable functions, or retaining uncertain nested callback code, can now leave analysis incomplete. The module-constant case was reproduced separately. Narrowing these cases requires additional attribute and control-flow analysis.

Validation: 30 new regression cases; 1,742 targeted tests passed in source and fresh installed-wheel runs. All 13 focused skills passed across base/head and source/wheel (52 CLI scans), including unsafe setup returning CAUTION/incomplete and harmless setup staying SAFE/complete. Fresh wheel/sdist package checks and Ruff lint/format passed. All 12 catalog skills also matched across base/head and source/wheel (48 more CLI scans). These were offline checks with no LLM provider. CodeRabbit and Greptile completed final-commit reviews with no new findings; the earlier conservative precision findings remain documented above.