Arcadia lost $3.5M to a call it let its caller shape. How a custom static detector catches that pattern on every commit, before the code ships.