- probe guard now inspects execute, fetch_one, fetch_all AND
execute_many calls, so bypasses through read/many paths are caught
- bare Name('raises') trusted only when the file's actual ImportFrom
nodes bind 'raises' from pytest; competing imports shadowing
'raises'/'pytest' from other modules fail closed