[codex] Implement v0.3 ADK and SARIF support

[pengfei-threemoonslab]

Summary

Implements the v0.3 roadmap bundle: static Google ADK support, SARIF output, report schema v0.3, ADK-specific readiness checks, shared local trace normalization, and updated docs/action metadata.

What changed

• Added google_adk manifest/source support with static Python AST and Agent Config YAML extraction.
• Normalized ADK function tools, OpenAPI toolsets, MCP inventory/toolsets, callbacks/plugins, sub-agents, eval references, and explicit inventories into the existing scan/report pipeline.
• Added six ADK readiness checks for dynamic toolsets, unfiltered MCP toolsets, missing metadata, long-running contracts, guardrail evidence, and production eval coverage.
• Added SARIF 2.1.0 output with canonical check metadata, help links, stable fingerprints, source locations, and capped evidence payloads.
• Added frameworks.google_adk to report schema v0.3 and surfaced ADK/SARIF outputs in CLI, Markdown, JSON, GitHub Action outputs, and docs.
• Added a Google ADK sample fixture and focused ADK/SARIF tests.

Why

v0.3 expands Agents Shipgate beyond OpenAI-first inputs while preserving the static, manifest-first Tool-Use Readiness wedge. The ADK adapter intentionally avoids importing user code, running ADK, connecting to MCP, calling tools, calling models, or making network calls by default.

Validation

• ruff check .
• pytest -q (134 passed)
• pytest --cov=agents_shipgate --cov-report=term-missing --cov-fail-under=75 (84.27%)
• python -m compileall -q src
• git diff --check
• python -m build
• python -m twine check dist/*
• PYTHONPATH=src python -m agents_shipgate scan --config samples/google_adk_agent/shipgate.yaml --out /tmp/shipgate-adk-sample --format markdown,json,sarif --ci-mode advisory