test: tier guard misses capture reads via a module-level CAPTURES tuple #2426

Describe the bug

tests/test_tier_guard.py claims to stop a unit-tier module from reading a generated sample capture, but doesn't catch this shape: tests/foundation/reassembly/test_datagram_deferred_pickle_2417_unit.py's SampleCaptureDatagramPickleTests.test_every_capture_with_tcp_flows_round_trips reads generated captures (http.pcap, stream.pcap, tcp.pcap, http6.cap, via a module-level CAPTURES tuple feeding a SAMPLE_ROOT import) from a _unit.py file, and the guard's AST analysis apparently doesn't follow that indirection — it ran green (135 passed/2505 subtests) on a tree carrying the violation. Found via PR #2421's CI going red on Python 3.11–3.15 (AssertionError: .../examples/captures/http.pcap is missing), since the unit-tests CI leg only runs make_samples.py for... actually doesn't run it at all for _unit.py modules — see #2417/#2421's fix-up PR for the immediate fix (moving the sample-dependent test class to a _runtime.py file).

Expected behavior

The guard should flag a unit-tier module whose tests read a path under examples/captures/ reached indirectly through a module-level tuple/constant, not just a literal path string inline in the test body.

Additional context

Found and reported by an agent during PR #2421 review (2026-10-29). Not urgent — the immediate CI break is being fixed directly — but the guard itself needs strengthening so this class of mistake is caught before merge next time.