v0.6.0: dependency-graph rules, install hook detection, R060 as INFO

TL;DR

Dependency-graph rules (D001-D004), install hook and patch-source rules (R062, R063), source downgrade detection (R064), R060 as INFO/weight 0 on by default, redesigned seed with 209k dependency names, and several measurement-found fixes to the dependency extractor and resolver alignment.

Added

• D-series dependency-graph rules, closing part of the documented build-dependency blind spot. All are off by default under a new [experimental_rules] config section, so baseline.json is unaffected until they are deliberately enabled.
  • D001 (HIGH) novel dependency: a name never observed anywhere in the AUR.
  • D002 (HIGH) typosquatted dependency, e.g. openss1 for openssl.
  • D003 (MEDIUM) makedepends gains a network-capable tool, so the build can fetch code no checksum covers.
  • D004 (HIGH) provides/replaces claims an established package unrelated to this one.
• R060 is now INFO (weight 0) and on by default. Fires on 21.4 % of benign diffs, so at weight 0 it reports context to a reviewer without touching any score.
• R061 (HIGH) a download inside a build function whose URL is absent from source=(). Off by default.
• R062 (HIGH) a .install hook that fetches or performs a privileged operation. Hooks run as root at install time.
• R063 (HIGH) a patch applied from a URL, an absolute path, or process substitution.
• R064 (MEDIUM) a source= URL downgraded from https to http.
• scripts/generate_seed.py records dependency names from .SRCINFO.
• tokenizer.resolve_added_lines() returns resolved lines with positions intact.
• The bundled seed is regenerated and now carries 209,909 dependency names, 179,956 URLs, and 35,903 maintainers.

Fixed

• _EXPERIMENTAL_DEFAULTS in analysis.py. load_config() reads the user's config.toml verbatim and never merged new defaults in, so existing installs never saw [experimental_rules]. Defaults now live in code.
• D004 did nothing when enabled on its own. It shared a guard clause with D001-D003, so the whole dependency block returned early unless one of those was also on.
• The dependency extractor read shell code as dependency names. An unbounded fallback for unquoted array entries pulled if, [[, and ! out of a package() body. Array termination is now quote-aware and bounded, tokens are validated against the Arch package-name grammar, and comments are stripped.
• resolve_added_lines() shifted every line after an assignment. It zipped its output against tokenize_and_resolve(), which omits assignment lines, so any added assignment made the two sequences different lengths. Substitution is now applied per line from a shared variable table.

Stats

• 1 commit since v0.5.1
• 689 tests (19 files), all passing
• Package version 0.6.0