[codex] add install vulnerability gate

[juangaitanv]

Summary

Adds package-manager install wrappers for npm, yarn, pnpm, pip, and uv that precheck install targets before handing off to the real package manager.

The gate now checks package publish recency, Corgea vulnerability verdicts, and OSV as a public secondary signal. It supports JSON output, --force, --no-fail, manager/project guardrails, named-package and tree coverage where safe, and package-manager stdout isolation for machine-readable output.

Impact

Developers and coding agents can run familiar commands such as corgea npm install ... and corgea pip install ... to block known vulnerable, malicious, unverifiable, or too-recent package installs before package-manager code runs.

Root Cause / Notes

The original CLI had dependency inventory scanning but no install-time guard. This change adds a pre-install command surface and preserves package-manager behavior when the gate passes. OSV can add public vulnerability blocks but does not weaken authenticated Corgea fail-closed verdicts.

Validation

• ./harness check passed: clippy fix, format, strict clippy, tests, deps skill drift; 322 tests passed.
• Pre-commit hook passed on commit: strict clippy, format check, tests; 322 tests passed.
• CORGEA_BIN=/Users/juan/Code/corgea/cli/target/debug/corgea ./scripts/validate-fixtures.sh passed across all ~/Code/corgea/test-cli fixtures.
• Live OSV smoke checks blocked known vulnerable installs:
  • npm:lodash@4.17.20, 5 OSV advisories, wrapper exit 1.
  • npm:express@4.18.2, 2 OSV advisories, wrapper exit 1.
  • PyPI:django@2.2, 64 OSV advisories, wrapper exit 1.