feat(scanner): add JS/TS AST env detection

[obmakesomething]

What changed

• Added an AST-backed JS/TS detector using @babel/parser when the parser is available.
• JS/TS files now prefer AST detection and fall back to the existing regex scanner if the parser is unavailable or parsing fails.
• Added detection for:
  • destructuring from process.env
  • aliases such as const env = process.env
  • helper calls such as env("KEY"), getEnv("KEY"), requiredEnv("KEY"), config("KEY"), readEnv("KEY"), and configured helper names
  • cleanEnv(process.env, { KEY: ... }) schema objects
  • static and dynamic process.env, import.meta.env, Bun.env, and Deno.env.get(...) access
• Updated README/docs to document the new coverage and source-checkout install flow.

Why

The v0.2 CI foundation made reports and gates trustworthy. This improves scanner credibility for real JS/TS repositories without exposing secret values, while preserving the existing GitHub Action smoke path that runs from a checkout without installing dependencies.

Validation

• npm test passed, 35/35
• npm run build passed
• npm run pack:check passed
• git diff --check passed
• No-dependency checkout smoke passed from /tmp: node --test test/*.test.js with the AST-only test skipped, then node src/github-action.js with redaction checks
• GitHub PR checks passed: node-tests, action-smoke

Non-goals

• No SARIF output.
• No provider integrations.
• No non-JS language scanners.
• No secret value reads or provider mutation.

Risk notes

• AST coverage is available when package dependencies are installed. Checkout-only GitHub Action execution safely falls back to the regex scanner instead of failing module load.
• Helper-call detection is intentionally configurable and may require project-specific tuning for noisy helper names.

[devloai]

Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔
Please upgrade your plan or buy additional credits from the subscription page.