detectors: packagehallucination misses packages after the first in import a, b

[WatchTree-19]

Summary

PythonPypi._extract_package_references only captures the first package on an import line:

imports = re.findall(r"^import\s+([a-zA-Z0-9_][a-zA-Z0-9\-\_]*)(?:\s*as)?", output, re.MULTILINE)

import a, b is valid Python, so for output like import os, hallucinated_pkg the detector extracts only os and silently ignores everything after the comma. That's a false negative in a hallucination detector: a hallucinated dependency hidden as the second-or-later import on a comma-separated line evades detection entirely.

Deterministic:

import os, hallucinated_pkg              -> {'os'}                       (hallucinated_pkg missed)
import numpy as np, faketorch, realmath -> {'numpy'}                    (faketorch missed)

Fix

Split the import clause on commas and take the top-level module of each. Dotted imports (import a.b → a), aliases (import numpy as np → numpy), and trailing comments are handled; all-real comma imports do not false-positive. The from ... import path is unchanged.

Test

No existing test covered comma-separated imports (the current Python tests are all single-import-per-line). Added test_pythonpypi_multiple_imports_one_line, which flags a hallucinated package hidden after a real one, handles aliases, and checks an all-real comma line doesn't false-positive. It fails on the old regex (the hidden package scores 0.0) and passes with the fix. Full Python suite: 6 passed.

Scope note: I kept this to the Python extractor, which is the clear case. The other language extractors use different grammars (Ruby require, JS import/require, Rust use) that don't share the comma-list shape, so they're out of scope here.

[jmartin-tech]

This PR includes commits not part of the scope it is meant to address. Please rebase to the described scope only.

[WatchTree-19]

Thanks, and apologies for the noise — you're right. The branch had picked up the braille commit from #1990. Rebased onto current main; it's now a single commit touching only packagehallucination.py and its test. The braille change is unaffected (it's still in #1990). Ready for another look.

Ready for code review and testing.