New language front-end (Go/Rust/Java) — deferred until TS is proven end-to-end

[Rinkia]

Adding a brand-new language front-end (Go, Rust, Java) via tree-sitter, emitting the shared Codebase model like languages/python.py and languages/typescript.py.

Why deferred (not ready yet)

High effort, and the model is not yet proven cross-language: the moddability benchmark is Python-only and the security lens is Python-only. Prove generalization on the TS front-end first (see the TS benchmark target + TS security sinks issues) before committing to a third language.

When it's time

• Add modscan/languages/<lang>.py implementing the LanguageParser protocol (languages/base.py), registering by name.
• Map the language's constructs to the shared model (functions/classes/bases/decorators/dynamic-imports).
• Add a benchmark target + labels for that language.

Tracking this so the idea isn't lost; do TS-completion issues first.

[Rinkia]

Closing: the milestone this asked for is delivered, for Java.

Delivered

• Java front-end (feat(java): Java language front-end (tree-sitter) #77) — modscan detect --language java, plus docgen and the security lens via the language registry. Generic bases reduced to their bare name (Core<T> → Core), annotation arguments dropped (@Plugin(name="x") → Plugin), nested classes deliberately not emitted as top-level seams, visibility from the explicit public modifier. Optional extra: pip install modscan[java].
• Java benchmark target (bench: add junit-jupiter-api, the first Java target, and record its baseline #78) — junit-jupiter-api 5.11.3, fetched as a version-pinned -sources.jar from Maven Central (benchmarks/java/fetch.py), labelled from the package's own Javadoc at that version. Baseline recorded: 4/7, aggregate 11/22 → 15/29.

Shipped in v0.1.7.

The precondition in the title — "deferred until TS is proven end-to-end" — was resolved first: TypeScript went 0/2 → 2/2 once two front-end defects it had been hiding were found and fixed (#73 CommonJS exports invisible, #76 .d.ts phantom symbols). Both were found only because a benchmark target existed, which is why Java shipped with its target in the same milestone rather than as a follow-up.

Not delivered

• Go and Rust. Only Java was done. Neither has a model-fit problem worth pre-judging, but neither is started — if either becomes wanted, it deserves its own issue rather than leaving a half-done multi-language issue open.

Worth knowing before starting another language

The Java baseline of 4/7 is weaker evidence than it looks. Eighteen candidates tie at exactly 1.00 and the order inside that band is strictly alphabetical, with the top-ten cutoff falling mid-alphabet — ParameterResolver (11), TestInstancePostProcessor (14) and TestWatcher (18) score identically to the four that made it. The alphabet decided that number.

So the current targets cannot distinguish a ranking that understands JUnit from one that sorts its interfaces alphabetically. A messier Java target (Spring, or a Minecraft mod API) would say considerably more than another language would. Details in benchmarks/README.md.