The probe guard now walks Call nodes (execute/fetch_one/fetch_all/
execute_many) rather than bare Await nodes, so calls wrapped inside
asyncio.gather or helper awaitables are still classified and cannot
hide a raw write from the sanctioned-function scan.