fix(supply-chain): gate vulnerable dependencies and scanner cache

[doublewhy]

Plain-language summary

• Context: OpenRAE ships a frozen Python dependency set and uses OSV Scanner in CI to detect known vulnerable packages.
• Problem: The lock contained vulnerable Click and cryptography versions, findings did not fail CI, and a cached scanner executable was trusted without proving that its bytes still matched the reviewed release.
• Fix: Upgrade the affected packages, make findings and scanner failures block CI, and verify the cached scanner by pinned digest and file identity before it can run.

Summary

Raise the reviewed Click and cryptography floors, refresh only their frozen lock entries, make OSV findings a required CI failure, and bind cached scanner execution to repository-pinned bytes.

Scope: OpenRAE core only. No experiment code, data, or results are changed.

Requirement UIDs

• GOV-913

Related issues

Closes #1098
Closes #1106

Related: #34

Because this PR targets dev, issue closure may need to be reconciled manually when the change reaches the default branch.

Stack

• Base: dev at 3d6e369b726607ff657a841c7f1dee0bec655b8f
• Depends on: none; independently mergeable

Changes

• Declare click>=8.3.3 and cryptography>=50.0.0, with a narrow frozen-lock refresh.
• Classify clean scans, vulnerability findings, and scanner/setup failures distinctly; both failure classes now fail CI while the JSON report still uploads.
• Revalidate cached scanner bytes on every use with repository-pinned checksums, bounded descriptor-based reads, identity checks, no-follow behavior where supported, atomic installation, a finite download timeout, and directory-creation race handling.
• Record the GOV-913 decisions and regression coverage for both issues.

Compatibility and release impact

• Compatibility: no SDL, runtime, schema, or public API change.
• Release effect: patch.
• CHANGELOG.md and the package version remain release-please owned.

Verification

• 159 passed, 1 deselected — repository policy and scanner regressions.
• 67 passed, 5 deselected — semantic CLI and module-registry signing surfaces.
• Live OSV scan: 92 locked packages, zero findings.
• uv lock --check: passed.
• Ruff check and format: passed for changed project/tooling files.
• Repository policy: passed; Ground Control was unavailable locally, so the remote governance lookup used its documented unavailable skip.
• Python 3.12 full unit run: 6421 passed, 1 skipped; 18 pre-existing macOS libvirt tests failed because /usr/bin/busybox is absent. No supply-chain test failed.
• Canonical integration, contracts, static/policy, and docs lanes passed. The local aggregate remained red on the same libvirt prerequisite, Python 3.14's already-tracked MCP event-loop tests, and the unavailable macOS Isabelle cache.

Coverage base: 3d6e369b726607ff657a841c7f1dee0bec655b8f

• Changed executable lines: 120/120 — 100%.
• Changed branch exits: 36/36 — 100%.

This does not claim 100% global repository coverage.

Traceability

• IMPLEMENTS: GOV-913 / #1098 ← dependency metadata, frozen lock, CI and nox admission.
• IMPLEMENTS: GOV-913 / #1106 ← scanner cache/download boundary.
• TESTS: GOV-913 / #1098 / #1106 ← test_repo_policy_tools.py.

Checklist

• Conventional lowercase PR title.
• No published schema change.
• Architecture and requirement decisions updated.
• No skipped task-specific check or known limitation omitted.
• No manual changelog or version edit.

Notes for review

This is deliberately independent of the Python-version and release-workflow successors. It keeps the networked OSV lane outside the hermetic verify graph while making that standalone lane required.

[Brad-Edwards]

Maintainer update after syncing this branch with current dev:

• Added supply-chain to the required status checks for both dev and main, so OSV findings and scanner failures now block merges as intended.
• Resolved the tools/osv_scanner_tool.py conflict by retaining this PR’s repository-pinned checksum/cache validation and atomic install behavior while using dev’s shared retrying HTTPS downloader. The shared downloader now accepts a bounded response size, with coverage for the limit.
• Moved the OCI image-reference grammar and ImageTrustPolicy implementation into a focused helper module to satisfy the repository’s 500-line source-file policy after the dev merge. The existing import surface from raes_reference_backend.drivers.oci is preserved.
• Extracted bounded-download validation/reading helpers after Sonar flagged the merged downloader’s cognitive complexity; behavior is unchanged.

The resolved branch has been pushed. Local canonical verification passed, and fresh CI is running on the latest commit.

[Brad-Edwards]

Follow-up: applied the repository-configured Ruff formatting to tools/http_download.py. The earlier local formatter invocation used Ruff’s default line-length setting, and the canonical CI formatter correctly detected the difference. This is formatting-only; the focused downloader/OSV suite remains green.