Require package-qualified enum types for trusted valueOf widen

Reject import-style polymorphic candidates when deciding whether an ambiguous valueOf widen is machine-scoped and safe to link.

Co-authored-by: Cursor <cursoragent@cursor.com>

state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicy.java

@@ -61,7 +61,8 @@ public final class CallChainLinkPolicy {
                 return false;
             }
             String enumType = pe.substring(0, pe.lastIndexOf('.'));
-            if (!MachineEnumCanonicalizer.enumTypesMatch(eventTypeFqn, enumType)) {
+            if (!enumType.contains(".")
+                    || !MachineEnumCanonicalizer.enumTypesMatch(eventTypeFqn, enumType)) {
                 return false;
             }
         }

state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java

@@ -59,4 +59,16 @@ class CallChainLinkPolicyTest {
         assertThat(CallChainLinkPolicy.isTrustedEnumPolymorphicWiden(trigger)).isTrue();
         assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isFalse();
     }
+
+    @Test
+    void shouldNotTrustImportStylePolymorphicWidenWithoutPackage() {
+        TriggerPoint trigger = TriggerPoint.builder()
+                .ambiguous(true)
+                .event("OrderEvent.valueOf(eventStr)")
+                .polymorphicEvents(List.of("OrderEvent.PAY", "OrderEvent.SHIP"))
+                .build();
+
+        assertThat(CallChainLinkPolicy.isTrustedEnumPolymorphicWiden(trigger)).isFalse();
+        assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isTrue();
+    }
 }