feat(sc10): detect direct dependency-source redirection

[Spectorian]

Summary

• Add deterministic HIGH findings for supported direct dependency-source configuration files.
• Report recognized executable surfaces as partial coverage pending a syntax-aware parser follow-up.
• Preserve sanitized deterministic evidence across terminal, JSON, Markdown, SARIF, and optional provider analysis.

Boundary

The rule is local and static-only. It does not execute content, make network, DNS, or reputation
requests, maintain user-managed trust lists, add telemetry, decide whether to install, or change
risk scoring or recommendation policy. Command and generated-configuration analysis are not part
of this change.

Verification

• Focused dependency-source, corpus, coverage, output, meta-analysis, report, and MCP suites passed.
• make lint and make format-check passed.
• make test-ci: 3,307 passed, 13 skipped, 38 deselected, and 5 expected xfails.
• The source distribution and wheel built successfully with python -m build.

[mohgupta-ship-it]

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

• Rating: new feature
• Confidence: medium
• Status read: Draft, CI green, no approval observed
• Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
• Council assessment: Large SC10 dependency-source parser/redaction/reporting surface. The PR body explicitly leaves command/generated-configuration analysis and some executable-surface coverage out of scope.
• Recommended action: Keep draft and require focused security/parser review before any ready-to-merge signal.