Tighten bare-constant filtering and valueOf widen policy

Scope bare polymorphic enum constants to the trigger parameter type (fail
closed on ambiguous simple names and cross-enum constant names), and fail
closed on runtime valueOf widens unless every candidate is package-qualified
for the trigger's declared event type.

Co-authored-by: Cursor <cursoragent@cursor.com>

state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java

@@ -33,4 +33,30 @@ class CallChainLinkPolicyTest {
         assertThat(CallChainLinkPolicy.resolveLinkResolution(trigger, List.of(), false))
                 .isEqualTo(LinkResolution.UNRESOLVED_EXTERNAL);
     }
+
+    @Test
+    void shouldFailClosedOnValueOfAmbiguousWiden() {
+        TriggerPoint trigger = TriggerPoint.builder()
+                .ambiguous(true)
+                .event("OrderEvent.valueOf(eventStr)")
+                .polymorphicEvents(List.of("a.OrderEvent.PAY", "a.OrderEvent.SHIP"))
+                .build();
+
+        assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isTrue();
+        assertThat(CallChainLinkPolicy.resolveLinkResolution(trigger, List.of(), false))
+                .isEqualTo(LinkResolution.AMBIGUOUS_WIDEN);
+    }
+
+    @Test
+    void shouldAllowTrustedMachineScopedValueOfWiden() {
+        TriggerPoint trigger = TriggerPoint.builder()
+                .ambiguous(true)
+                .eventTypeFqn("com.example.OrderEvent")
+                .event("OrderEvent.valueOf(eventStr)")
+                .polymorphicEvents(List.of("com.example.OrderEvent.PAY", "com.example.OrderEvent.SHIP"))
+                .build();
+
+        assertThat(CallChainLinkPolicy.isTrustedEnumPolymorphicWiden(trigger)).isTrue();
+        assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isFalse();
+    }
 }