fix(security): mask unaliased PII expressions (D2 #125 follow-up)

[brownjuly2003-code]

What

Closes the unaliased-expression PII leak flagged as a known follow-up in
#125 — the last D2 masking bypass shape.

SELECT upper(email) FROM users_enriched      -- output column: upper(email)
SELECT email || '' FROM users_enriched        -- output column: (email || '')

An unaliased expression has no alias_or_name, so _projection_source_columns
skipped it entirely; the result column kept DuckDB's rendered name
(upper(email), (email || '')), which never matched a masking rule field, so
the PII was returned cleartext with no X-PII-Masked signal. Reproduced
against live DuckDB: was_masked=False.

A name-based fix is impossible because sqlglot's rendering does not reproduce
DuckDB's column naming — UPPER(email) vs upper(email), email || '' vs
(email || '') (case and parenthesisation differ).

Fix

Align projections positionally to the real result keys (projection order ==
result-column order), which mask_query_results already has from the rows. Each
projection is then keyed by its true DuckDB output name:

• aliased / bare-column projections keep the fix: close audit_30 backlog — 1 HIGH + 6 MEDIUM (Workstream C / R3) #118/fix: close 3 defects from a fresh adversarial audit of #118–#122 (1 HIGH + 2 MEDIUM) #123/fix: close 2 residual defects from auditing #123/#124 (1 MEDIUM PII leak + 1 LOW DDL race) #125 deep-lineage ∪
  shallow resolution (incl. the SELECT*-blinded fail-closed star leaf);
• an unaliased expression is masked by the columns it directly references
  (upper(email) → email);
• a top-level SELECT *, a parse failure, or a projection/result-key count
  mismatch still falls back to name-matching (return None), so existing
  behaviour is unchanged.

This completes the D2 masking surface: aliased renames, subquery/CTE renames,
SELECT *-blinded inner renames (#125), and now unaliased expressions are all
masked.

Verification

• Counterfactual (stash the fix, keep the tests): the unaliased test fails
  on post-fix: close 2 residual defects from auditing #123/#124 (1 MEDIUM PII leak + 1 LOW DDL race) #125 code (SELECT upper(email) → masked=False, cleartext) and
  passes with the fix.
• No over-masking: a new invariant test pins that a directly-named non-PII
  column alongside a PII one (SELECT email, user_id) keeps user_id untouched
  — positional alignment keys each projection to its own column.
• Full unit suite green; ruff + ruff format clean; mypy --strict clean.
  Independently reproduced closed against live DuckDB; top-level SELECT *
  name-match and all prior D2 shapes still pass.
• masking.py mutation score is unaffected (the mutation harness covers the
  masking primitives, not the lineage/projection resolver).

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 137 total / 31.97 per week
• Lead time for changes: avg 0.31h / median 0.0h
• Change failure rate: 79.56% (109/137)
• MTTR: 0.25h across 3 incident(s)