feat(reporting): structured reachability evidence ladder for dependen…

[bearsyankees]

…cy CVE findings

[greptile-apps]

Greptile Summary

The PR adds structured static-reachability evidence to dependency CVE reports without changing advisory-based severity.

• Adds validation, persistence, and rendered evidence for five reachability levels.
• Displays usage evidence in live dependency-report TUI output.
• Installs govulncheck and the Go toolchain in the sandbox image.
• Expands the dependency-scanning skill with ecosystem-specific analysis guidance and adds reporting-field tests.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code defects identified.

Reachability values are validated before persistence, evidence is retained in structured metadata and rendered report text, severity remains advisory-driven, and the sandbox wiring exposes both govulncheck and its required Go toolchain.

Important Files Changed

Filename	Overview
containers/Dockerfile	Installs govulncheck, copies it through the existing Go-tool builder path, and provides the runtime Go toolchain required for analysis.
strix/interface/tui/internal/render/dependency.go	Adds conditional display of non-unknown reachability levels and their supporting evidence from dependency-report arguments.
strix/skills/custom/dependency_cve_scanning.md	Defines a structured static-analysis evidence ladder and guards against treating reachability as an exploitability or severity verdict.
strix/tools/reporting/tool.py	Validates reachability values and evidence, persists them in dependency metadata, and incorporates a human-readable usage analysis into report evidence.
tests/test_reporting_fields.py	Covers accepted reachability metadata, evidence requirements, invalid levels, unknown-level omission, severity independence, and tool-schema exposure.

_{Reviews (1): Last reviewed commit: "feat(reporting): structured reachability..." | Re-trigger Greptile}