[codex] Add first-pass PyPI, Go, and Cargo support

[hammadtq]

Summary

This adds first-pass multi-ecosystem support to attach-guard for direct pip / pip3 install, go get, and cargo add commands.

What Changed

• added new ecosystems and parser support for PyPI, Go, and Cargo
• introduced HasUnparsedArgs so recognized-but-unevaluable commands avoid false denies and mixed commands cannot be rewritten unsafely
• taught the evaluator to force manual review when a command mixes evaluable packages with skipped inputs
• made rewrite output ecosystem-aware: == for pip, @v for Go, @= for Cargo
• extended the Socket provider to fetch and sort candidate versions from PyPI, the Go proxy, and crates.io before scoring them
• added config toggles and default plugin config for the new package managers
• updated tests and docs to cover the scoped first-pass behavior and deferred cases

Design Notes

This PR intentionally keeps the first pass narrow:

• supported: direct pip / pip3 install, go get, cargo add
• deferred: wrapper forms like python -m pip, uv pip, go install, cargo install
• deferred: pip ranges/extras, Cargo non-exact requirements, and Go non-semver queries
• recognized commands with unevaluable args are allowed through when nothing can be evaluated, and forced to ask when mixed with evaluable packages

Validation

• go test ./...
• go vet ./...
• go build ./...

[hammadtq]

LGTM