feat(conda): add conda/pixi ecosystem support, baseline roots, and first exposure catalogs

[jviehhauser]

Adds conda/pixi as bumblebee's 9th ecosystem, wires up baseline roots so a default scan picks up the common install layouts, and ships two threat-intel catalogs that exercise the new code path.

What's in the diff

Scanner. internal/ecosystem/conda parses <env>/conda-meta/<name>-<version>-<build>.json — the canonical install record conda, mamba, micromamba, and pixi all share. Each record carries the exact name, version, build, and channel emitted by the package builder, so a parsed record is high-confidence proof of an installed version. Pip-installed packages that conda records under the same conda-meta/ directory (channel = pypi) surface as package_manager=pip so receivers can tell them apart from conda-channel installs.

Roots. Baseline now picks up ~/.pixi, ~/miniconda3, ~/anaconda3, ~/miniforge3, ~/mambaforge, ~/micromamba, and the Homebrew --cask anaconda prefixes (/opt/homebrew/anaconda*, /usr/local/anaconda* — glob-discovered so versioned variants are caught too).

File-size default. Bumped --max-file-size from 5 MiB → 16 MiB. conda-meta records enumerate every file a package ships and reach 16+ MiB on bundles like google-cloud-sdk; the old default silently skipped them.

Catalogs. Two new files in threat_intel/:

File	Entries	What
conda-forge-metadata-2025-03-04.json	1 × pypi	CVE-2025-27510 dep-confusion RCE in conda-forge-metadata ≤ 0.4.1 via the unregistered conda-oci-mirror optional dep
conda-tooling-2025-06-14.json	3 × conda	CVE-2025-32798/-32799 against conda-build ≤ 25.3.2 (recipe-selector RCE + Tarslip), CVE-2025-49824 against conda-smithy ≤ 3.47.0 (RSA padding-oracle) — all from the 7ASecurity / OSTIF / STA conda-forge audit

conda-build and conda-smithy ship only via conda-forge (their PyPI namesakes are inert placeholders pointing readers to the conda channel), so those advisories are properly ecosystem: conda and rely on this PR's scanner to fire.

Proof it works

Live scan against a real macOS host with a Homebrew Anaconda install plus pixi envs:

profile=deep status=complete duration_ms=10597
files_considered=887751  findings_emitted=3

  conda/conda-build@3.21.9   → CVE-2025-32798 (recipe-selector RCE)
  conda/conda-build@3.21.9   → CVE-2025-32799 (Tarslip path traversal)
  conda/conda-smithy@3.21.3  → CVE-2025-49824 (RSA padding-oracle)

Patched installs (conda-build 26.3.0, conda-smithy 3.59.0 in pixi envs) produced zero findings. bumblebee selftest reports selftest OK (4 findings in 3ms) with a new conda fixture that exercises the channelFromURL fallback — the most bug-prone code path here, since every real conda-meta record on a typical pixi host omits the schannel field the parser would otherwise short-circuit on.

What's not here, and why

No conda "campaign" catalog. I looked — there isn't one to cite. conda-forge's Apr 2025 token-exposure postmortem found no shipped malicious packages, the Jul 2025 audit findings are infrastructure hardening, conda-forge was unaffected by xz CVE-2024-3094, and the Shai-Hulud / Mini-Shai-Hulud / TrapDoor campaigns are npm + PyPI with no public record of conda republication. When the next cross-ecosystem campaign hits a conda-forge feedstock, mirroring affected names under ecosystem: conda will be a few-line follow-up.

No pixi.lock / pixi.toml parsing. conda-meta is the authoritative installed-state source and is shared by every conda-compatible tool; a lockfile parser would need hand-rolled YAML (à la pnpm) and is its own PR.

Cross-ecosystem refactors deferred. A 3-agent maintainability audit on the final commit surfaced items worth doing — centralising the scanner dispatch, extracting readBounded (now duplicated across pypi/composer/conda), a typed PackageManager alias, per-ecosystem MaxFileSize, and conda cases in scanner_integration_test.go. Each touches all 9 ecosystems, so they belong in focused follow-up PRs rather than threading through this diff.

Security review

Multi-agent review on this branch returned zero HIGH/MEDIUM findings. Six concerns were investigated and cleared: symlink behaviour in walk dispatch, JSON-decode robustness against attacker input, NDJSON output injection, walk-dispatch case ordering, credential exposure via the new conda roots, and readBounded parity with the established pypi/composer precedent.

Test plan

• go build ./..., go test ./..., go vet ./..., gofmt -l . clean
• bumblebee selftest — 4 findings, including the conda fixture that exercises channelFromURL
• Both catalogs load via --exposure-catalog without parse errors
• 17 synthetic match probes pass (positive, negative, ecosystem isolation, case-insensitive normalisation, URL-shape coverage)
• Real-host end-to-end run: 3 expected findings + 320 package records + 0 diagnostics
• Cross-platform spot-check (Linux conda installs, micromamba envs)

Supersedes #37 (closed; commits cherry-picked here).