test(security): add comprehensive test suite for security and complia…

[squid-protocol]

…nce spokes

This commit locks down the primary GitGalaxy security modules with zero-trust validation:

• Vault Sentinel: Verifies path-blocking and mock-key allowlist logic for hardcoded secrets.

• Supply Chain Firewall: Proves strict-mode package blocking and inert data shields.

• X-Ray Inspector: Validates magic-byte detection and entropy routing for binary anomalies.

• Network Mapper: Asserts multi-framework regex traps and ghost/shadow API set math.

• SBOM Generator: Verifies CycloneDX formatting and cross-ecosystem manifest parsing.

Description of Structural Changes

Visual Observatory Testing

• I tested the output JSON on GitGalaxy.io OR the Airgap Observatory.
• Flexbox constraints, HUD elements, and 3D rendering remain intact.

The Differential Scan Acknowledgement

• I understand that my PR will be subjected to a Full Differential Scan.
• I have provided the link to the specific repository this PR addresses so it can be tested alongside the 80-repo calibrated baseline.
• I believe these changes will measurably improve the engine's Accuracy, Speed, Utility, or Ethos without causing regressions.

[squid-protocol]

Description of Structural Changes

GitGalaxy's architecture requires absolute zero-trust validation when processing legacy or third-party code. This PR introduces 483 lines of comprehensive, high-speed integration tests to lock down the primary security and compliance spokes.

To ensure the CI/CD pipeline remains lightning-fast, these tests heavily utilize unittest.mock to intercept the ML-driven SecurityLens, proving the structural routing and mathematical logic without the overhead of booting the neural auditor.

The Zero-Trust Testing Matrix:

• 🛡️ Vault Sentinel: Mathematically proves the pre-commit hook instantly blocks .pem/.key files while safely bypassing known mock directories via the ALLOWLIST.
• 🧱 Supply Chain Firewall: Verifies the STRICT_IMPORT_MODE package-blocking logic and proves the "Inert Data Shield" correctly neutralizes false-positive threats in minified (.min.js) files.
• ☢️ X-Ray Inspector: Validates magic-byte detection (e.g., catching PE32 executables disguised as .jpg) and entropy routing for binary anomalies.
• 📡 Network Mapper: Asserts the multi-framework regex traps across 9 languages and verifies the set-difference math for detecting Shadow and Ghost APIs.
• 📦 SBOM Generator: Proves cross-ecosystem manifest parsing (NPM, Cargo, PyPI, Maven, etc.) and enforces strict CycloneDX 1.4 JSON schema compliance.