refactor(modules): fold dep-scanner into code-scanner as the deps subsystem

[ralyodio]

Resolves the open module-boundary question in PRD 0002.

Why

PRD.md already assigns "dependency CVEs" to code-scanner, so shipping a separate dep-scanner module contradicted the product doc. Two modules would also have:

• walked the same directory trees twice,
• held two inventories of the same packages,
• given the operator two path lists to keep in sync,

for a user-visible surface (threatcrush scan --deps) that was always meant to be one command.

The arguments for splitting were real, but all internal: a package-graph data model, an external advisory database, and a per-ecosystem parser surface that will keep growing. Those are preserved as a subsystem boundary rather than a module boundary.

What changed

modules/dep-scanner/src/{inventory,osv,scripts,semver}.ts
  -> modules/code-scanner/src/deps/

• src/deps/index.ts is the new subsystem entry point. scanDependencies() takes options and returns a result with no ModuleContext, so the same code serves both the scheduled daemon scan and the one-shot scan --deps.
• src/index.ts is now a thin host that runs enabled subsystems and owns alerting/dedupe, with stubs documented for secrets/, sast/ and config/ — the rest of code-scanner's remit per PRD.md.
• Dependency config is namespaced deps_* so sibling subsystems can be configured without collision. paths, min_severity, scan_interval_seconds and the fail_on_unparseable honesty switch stay shared.
• PRD 0002 updated: the boundary question is marked resolved, implementation: set, and the UX/config sketches re-cast around code-scanner.

Verification

• 41 tests pass (unchanged — this is a move plus a host rewrite, not a behaviour change).
• pnpm build clean; repo pre-commit hooks (CLI + web build) pass.
• Re-ran against the reference pnpm workspace that motivated the PRD: still resolves 21 roots / 101 packages, versus the 0 dependencies, coupling 0/100 (good) that the original analyzer reported.

Git tracked every file move as a rename, so the diff is reviewable as such.

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.