em 02: data-flow classification (params/returns/locals buckets)

- Tooling/DataFlowClassifier: buckets a resolved selection via Roslyn
  DataFlowAnalysis. Selection flow + tail flow (statements AFTER the
  selection in the same block) both use the two-argument AnalyzeDataFlow
  overload on the contiguous run; the em 01 spike verdict is pinned in
  tests — a synthetic BlockSyntax (parent decision #3) throws
  ArgumentException "statements not within tree" and would re-bind
  symbols, breaking the written-inside ∩ read-after identity match.
- Buckets per parent spec as plain-string records: in-params = local +
  parameter reads (filtering the implicit `this`; fields/properties stay
  in the em 03 extract-first bucket), ByRef = reassigned inside via a
  non-declaration write (declaration initializers are not write-backs),
  returns = written ∧ read-after (tail, branch-insensitive
  over-approximation) + trailing `return X;` simple-name candidate,
  locals = written ∧ never read-after.
- CLI now prints the raw bucket dump after the statement count line;
  classification failures exit 1 with a clean message (exit 0/1/2
  contract preserved).
- Tests: 6 new (in-param incl. `this` non-leak, multi-statement
  two-argument path, trailing-return, ref-vs-in differential, extract-first
  non-leak, synthetic-block dead path, single-statement one-argument path);
  shared DemoFixture loader; fixed pre-existing CS8602 in DemoFixtureTests.
  36/36 green.

tests/BeforeAfter.Tests/ExtractMethod/DemoFixtureLoader.cs

@@ -0,0 +1,32 @@
+using ExtractMethod.Tooling;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+
+namespace BeforeAfter.Tests.ExtractMethod;
+
+/// <summary>
+/// Shared entry point for the ExtractMethod tests: the checked-in Demo.cs
+/// fixture is DATA (excluded from this project's compilation, copied to the
+/// output dir) and must ALWAYS be loaded through the tool's own
+/// <see cref="CompilationLoader"/> so tests exercise the exact parse +
+/// scratch-compilation path the CLI uses.
+/// </summary>
+internal static class DemoFixture
+{
+    /// <summary>Where the fixture lands after the csproj copies it (link Fixtures/).</summary>
+    public static string Path =>
+        System.IO.Path.Combine(AppContext.BaseDirectory, "Fixtures", "Demo.cs");
+
+    /// <summary>Parse + scratch-compile the fixture once per caller.</summary>
+    public static (SyntaxTree Tree, CSharpCompilation Compilation) Load()
+    {
+        if (!File.Exists(Path))
+        {
+            throw new FileNotFoundException($"fixture missing at {Path}");
+        }
+
+        var tree = CompilationLoader.ParseFile(Path);
+        var compilation = CompilationLoader.CreateCompilation(tree, "DemoFixture");
+        return (tree, compilation);
+    }
+}