Python detector + dependency-addition detector

[Conalh]

Summary

Closes the audit's biggest coverage gap and addresses the missing manifest-layer capability signal. Stacked on top of #3 (Harden GitHub Action runtime) — merge #3 first, then this.

What changed

Python detector (src/detectors/py-capability.ts)

Why: agents that ship Python were previously invisible to CapabilityEcho even though Python is the dominant agent runtime.

• Network: requests/httpx/urllib calls (requests.get, httpx.post, urllib.request.urlopen, bare urlopen after from urllib.request import urlopen, aiohttp.ClientSession), gated on a literal URL on the same line — parallels the JS gate.
• Subprocess: subprocess.run/call/Popen/check_*, os.system/popen/execv*/spawn*, pty.spawn, legacy commands.getoutput — high severity.
• Dynamic exec: eval, exec, compile, __import__, importlib.import_module — critical (medium in test files).
• Unsafe deserialization (new finding kind): pickle.load/loads, marshal.load/loads, yaml.load without SafeLoader — critical.
• Comment lines (#) and test files (tests/, test_*.py, *_test.py) handled.

Dependency-addition detector (src/detectors/package-deps.ts)

Why: a PR that adds puppeteer to dependencies is materially more interesting than a PR that just imports something already declared.

Diffs package.json across dependencies / devDependencies / optionalDependencies / peerDependencies on both sides:

• high_capability_dep_added (high) — headless browsers (puppeteer, playwright, cypress, webdriverio, selenium-webdriver, nightwatch), subprocess/PTY wrappers (execa, cross-spawn, node-pty, shelljs, zx), arbitrary HTTP clients (node-fetch, undici, got, axios, request, superagent), VM/eval libs (vm2, isolated-vm), SSH/proxy primitives.
• telemetry_dep_added (medium) — Sentry/Segment/Mixpanel/Amplitude/PostHog SDKs (ship outbound network by default).

Reuses package-scripts.ts diff infrastructure (PackageDiffMode, readPackageTextAt, listChangedPackageJsonFiles are now exported).

Plumbing

• paths.ts recognizes .py/.pyw in isScannable, adds isPyFile, treats # as a comment, extends isTestFile for Python conventions.
• diff.ts wires both new detectors in. detectPackageScripts and detectPackageDeps run in parallel via Promise.all.

Verification

• `npm run build` — clean.
• `npm test` — 30/30 passing (14 prior + 11 Python + 5 dependency).
• README updated to describe Python coverage and dependency surface.

Test plan

• CI build-test job passes
• CapabilityEcho self-dogfood detects: this PR adds no risky deps but does compile new detector code