feat(enrichment): dependency-diff + OSV.dev CVE analyzer

[JSONbored]

Context

First analyzer for the review-enrichment service (REES). Depends on the service scaffold issue (server, auth, config, orchestrator, render) being merged. The engine reviewer cannot resolve a dependency tree or hit a CVE DB; this analyzer parses manifest diffs and flags vulnerable/yanked/typosquat dependency changes, contributing findings + a rendered section to the review brief. Highest-value analyzer (security), so it ships first.

Requirements

• Parse manifest diffs from the request files[] patches: package-lock.json, requirements.txt, go.mod, Cargo.toml, pom.xml. Resolve added/bumped dependency versions; classify direction (upgrade/downgrade).
• OSV.dev CVE lookup over HTTPS on the NEW versions (no API key needed). Flag downgrades, yanked versions, and typosquat-suspect names.
• Runs under its own per-analyzer sub-budget inside the orchestrator's Promise.allSettled; a slow/failed lookup degrades to analyzerStatus.dependency:'degraded' + partial:true, never blocks the others.
• OSV.dev must be reachable over HTTPS from the Railway service; optionally bake osv-scanner into the runtime image, OR call OSV.dev over HTTP to avoid baking Python (prefer the HTTP path to keep the image lean).

Deliverables

• review-enrichment/src/analyzers/dependency-scan.ts: manifest-diff parser per ecosystem → resolved added/bumped deps → OSV.dev lookup → dependency findings [{ package, from, to, cves:[{id,severity,summary,fixedIn}], direction }].
• Register the analyzer in brief.ts (gated by the per-repo enrichment.analyzers list) and contribute its lines to the rendered promptSection via render.ts.
• Dockerfile: if osv-scanner is baked, pin it; otherwise document the HTTPS OSV path. Update the orchestrator's analyzerStatus to include dependency.

Acceptance criteria

• A PR bumping a package to a version with a known CVE produces a dependency finding with the CVE id/severity/fixedIn and a rendered brief line; a clean bump produces none.
• A downgrade and a yanked/typosquat-suspect change are flagged.
• OSV timeout/error degrades that analyzer only (degraded, partial:true); the rest of the brief still ships.
• Unit tests cover each ecosystem parser, the OSV lookup (mocked), and the degrade path. npm audit --audit-level=moderate clean. (Service code not Codecov-measured; tests included for regression safety.)

Parent: #1029