epic: publish-time malware scanning and dual-use package policy

Outcome

Every package artifact accepted by the Pantry registry/API is automatically malware-scanned before it becomes installable. Malware is blocked, scanner failures fail closed, dual-use packages carry durable disclosure metadata, and operators can observe and rehearse the control.

This tracks parity with npm's July 28, 2026 publish-time scanning behavior: https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/

Workstreams

• #222 — scanner abstraction, clamd integration, limits, fail-closed behavior
• #223 — gate core, commit, Zig, and PHP publish routes; atomic batch scanning; persist verdict metadata
• #221 — contentPolicy, root text-only DISCLOSURE, persistence across versions, auth-policy groundwork
• #220 — deployment, fresh signatures, health/readiness, metrics/audit events, alerts, rollout and incident runbook

Security invariants

1. No new installable package bytes are persisted before a clean scan verdict.
2. Scanner timeout, outage, or malformed response cannot degrade into allow.
3. A blocked member prevents an entire multi-package commit batch from being published.
4. Dual-use declarations provide context only; they never override a malware verdict.
5. No package contents, credentials, or disclosure text enter logs/metrics.
6. Tests prove all public API publication paths pass through the gate.
7. Any remaining direct object-storage publication path is treated as a bypass and must be migrated or equivalently gated before rollout completes.

Definition of done

• All child acceptance criteria pass.
• Registry tests, typecheck, lint, and docs contract checks pass.
• Production service runs a private, signature-updated scanner.
• EICAR is rejected end-to-end and leaves no installable artifact.
• Clean fixtures publish through every supported endpoint.
• Scanner outage returns a retryable failure and writes nothing.
• Operator runbook covers false positives, stale signatures, outage, and recovery.
• Release notes explain the publish-time delay and dual-use metadata requirements.

Rollout note

Code completion is not production completion. Keep this epic open until scanner deployment and the EICAR/outage rehearsals are confirmed in the production-equivalent environment.