feat: add upstream reachability and pull-through services

[DevonL]

📄 Summary

Adds capabilities for dependency fetching via available upstreams

🔍 Related Issues

Link to any related GitHub issues (e.g., Fixes #12, Closes #34):

🧪 Type of Change

Please check the relevant type tag for this PR title:

• [FIX] Bug fix
• [NEW] New thing
• [REFACTOR] Internal changes such as code restructuring or optimization that does not alter functionality
• [DOC] Documentation-only changes
• [CHORE] Maintenance, cleanup, or CI configuration

🧪 How Has This Been Tested?

Describe how you tested your changes. Include CI runs, local tests, manual verification, or screenshots if applicable.

📸 Screenshots (if applicable)

If UI or logs are affected, include before/after screenshots or output.

✅ Checklist

• I’ve read and followed the CONTRIBUTING.md.
• I’ve added or updated documentation as needed.
• I’ve verified the change is tested and works as intended.
• CI/CD checks pass and do not break existing functionality.
• My code follows the style guidelines of this project.

[Copilot]

Pull request overview

This PR introduces upstream reachability and pull-through services that enable dependency fetching via available upstreams in Cloudsmith. The implementation adds comprehensive capabilities for checking upstream availability and orchestrating dependency pulls through multiple package formats.

Changes:

• Adds UpstreamPullService class for orchestrating concurrent dependency pulls with authentication-aware redirect handling
• Implements upstreamGapAnalyzer for enriching dependencies with upstream reachability information
• Creates utility modules for registry endpoint management, package name normalization, and upstream format handling
• Refactors UpstreamChecker to expose upstream state queries for external consumption
• Adds comprehensive test coverage for both services and their integration scenarios

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
util/upstreamPullService.js	Main service class that handles pull-through caching with concurrent request management, redirect validation, and authentication failure handling
util/upstreamGapAnalyzer.js	Analyzes uncovered dependencies across repositories to determine upstream reachability with progress reporting
util/registryEndpoints.js	Constructs registry trigger plans and validates registry URLs for 13+ package formats
util/packageNameNormalizer.js	Provides package name normalization and ecosystem-to-format mapping utilities
util/upstreamChecker.js	Refactored to export helper functions and add new method for querying active upstreams by format
test/upstreamPullService.test.js	Tests registry URL construction, mixed-ecosystem handling, redirect validation, and concurrency controls
test/upstreamGapAnalyzer.test.js	Tests dependency classification, upstream detection, and concurrency limiting

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DevonL]

Closing this PR because the initial split/stacking strategy was incorrect and produced oversized, overlapping diffs.

A clean stacked PR set will be reopened from the original feature branch.