Feature: Add production reliability and data-readiness checks across languages

[alxxjohn]

Summary

This PR adds the first production-readiness rule families to CodeGuard: Reliability and Data Correctness, plus a diff-mode
pr_summary.production_risk artifact.

The goal is to move CodeGuard beyond general code quality checks and into production-safety review: detecting outage risks,
unsafe retry behavior, missing cleanup/cancellation, data-loss patterns, idempotency gaps, dual writes, unsafe pagination,
unbounded reads, cache policy gaps, and unsafe rolling schema migrations.

This branch adds coverage across:

• Go
• Python
• TypeScript
• JavaScript
• C++

Major changes

Reliability checks

Adds a new Reliability section with config, catalog metadata, fix templates, SDK aliases, profile/default wiring, and detector
implementations.

Implemented rule IDs include:

• reliability.missing-timeout
• reliability.unbounded-retry
• reliability.retry-without-backoff
• reliability.non-idempotent-retry
• reliability.missing-cancellation
• reliability.unbounded-work
• reliability.missing-concurrency-limit
• reliability.resource-leak
• reliability.partial-failure-hidden
• reliability.missing-graceful-shutdown
• reliability.swallowed-error
• reliability.lost-error-context
• reliability.recoverable-panic

Coverage includes language-specific heuristics for HTTP timeout evidence, retry/backoff/idempotency patterns, unbounded async/
thread/goroutine work, cleanup/resource ownership, swallowed errors, generic exceptions/panics, and Go cancellation/shutdown
patterns.

Data Correctness checks

Adds a new Data Correctness section with config, catalog metadata, fix templates, SDK aliases, profile/default wiring, and
detector implementations.

Implemented rule IDs include:

• data.read-modify-write-race
• data.missing-transaction-boundary
• data.side-effect-in-transaction
• data.non-idempotent-consumer
• data.missing-deduplication
• data.unsafe-dual-write
• data.missing-outbox-strategy
• data.unstable-pagination
• data.unbounded-read
• data.exactly-once-assumption
• data.cache-without-policy

Coverage includes transaction-boundary gaps, unsafe dual writes, missing outbox evidence, idempotency/deduplication gaps in
consumers, unstable offset pagination, unbounded reads, exactly-once assumptions, and cache writes without TTL/policy evidence.

Production risk artifact

Adds an additive diff-mode pr_summary.production_risk artifact.

It rolls up reliability, data-correctness, and unsafe schema-migration findings into deterministic PR-level risk evidence. This
does not change individual finding severity, SARIF output, GitHub annotations, or the existing text summary behavior.

Contract migration compatibility

Adds contracts.non-expand-contract-migration as the production-readiness migration signal.

The scanner now emits this alongside the existing contracts.migration-destructive finding. This preserves compatibility with
existing waivers/baselines while allowing production-risk scoring to treat non-expand/contract migrations as data-correctness
risk.

Tests and coverage

Adds broad positive and negative tests for reliability/data detectors across Go, Python, TypeScript, JavaScript, and C++.

The tests cover both risky patterns and safe patterns, including bounded HTTP calls, concurrency limits, transaction/outbox/
idempotency evidence, TTL cache writes, bounded queries, and deterministic pagination.

Docs and examples

Updates:

• docs/checks.md
• docs/features.md
• docs/production.md
• examples/codeguard.json

These now document the new reliability, data, and production_risk config surfaces and implemented behavior.

Validation

Passed:

go test ./tests/checks -run 'Test(Reliability|Data)'
go test ./internal/codeguard/checks/reliability ./internal/codeguard/checks/data ./tests/cli -run
'TestSDKRuleMetadataFor(Reliability|Data)'
go test ./tests/checks -run 'TestContracts(Migration|FullScan)'
go test ./tests/cli -run 'TestSDKRuleMetadataFor(Reliability|Data|NonExpand)'
go test ./...
make codeguard-ci
make ci

go test ./... and make ci were run with localhost access allowed for existing httptest suites.

Notes for reviewers

The new non-Go detectors are intentionally heuristic/confidence-based where full semantic proof would require framework-specific
analyzers. The tests include safe-pattern negatives to keep the first rollout from being purely noisy positive detection.

The branch keeps rollout staged through config/profile wiring rather than making every new production-readiness rule globally
blocking by default.