feat(df): add df parent command with npm-config and ci-summary

Description

Fourth MR in the glab dependency-firewall (alias df) stack. Builds on the cilog/summary MR.

Adds the first user-facing command surface — everything except the npm wrapper (which needs the proxy):

• glab dependency-firewall (alias glab df) — the parent command, registered on the root command.

• glab df configure <package-manager> — write a package manager's resolve and deploy registry URLs to .gitlab/df/config.json (--repo-resolve, --repo-deploy, each a full registry URL). The manager is a positional argument validated against the supported list (npm today), so later stack slices extend one command instead of adding a new top-level name per manager. Create-or-merge: only the flags you pass are updated, and existing values, other managers' blocks, and unknown keys are preserved.

• glab df ci-summary — render the firewall summary from .gitlab/df/ci-log.json, and exit 3 when the log contains a blocked entry so a CI job can distinguish a policy violation from a command failure:

  Exit code	Meaning
  0	No blocked entries in the log (allow-only, warnings, or no log at all).
  1	The log could not be read.
  3	At least one entry in the log is blocked.

Both commands resolve .gitlab/df/ against the current working directory, which is where a firewall run writes its log and where the package manager reads its config. That contract is stated in each command's help.

--repo is deliberately not enabled for these commands: neither resolves a GitLab project, so the flag would be documented but inert. The package-manager wrappers that do resolve a project enable it themselves.

The df npm subcommand is intentionally absent until the next MR. The generated docs under docs/source/dependency-firewall/ are included, and all three commands carry the text.BetaString banner.

Related Issues

• gitlab-org/gitlab#603648+s
• MRs split out from Draft: POC feat(df): add GitLab Dependency Fire... (!3429) • Michael Eddington

How has this been tested?

Unit tests, plus manual checks. No GitLab Dependency Firewall policy is needed for these commands — they only read and write local files.

Automated

go test ./internal/commands/df/...
make gen-docs   # no diff
make lint       # clean

Manual

make build
cd /path/to/any/directory   # no GitLab remote required; these commands are local-only

# Parent help lists configure and ci-summary (no npm yet); df is an alias:
./bin/glab dependency-firewall --help
./bin/glab df --help

# Write config with full registry URLs and confirm the file:
./bin/glab df configure npm \
  --repo-resolve https://gitlab.com/api/v4/projects/42/packages/npm/ \
  --repo-deploy  https://gitlab.com/api/v4/projects/42/packages/npm/
cat .gitlab/df/config.json
# {
#   "npm": {
#     "repoDeploy": "https://gitlab.com/api/v4/projects/42/packages/npm/",
#     "repoResolve": "https://gitlab.com/api/v4/projects/42/packages/npm/"
#   }
# }

# Re-run with one flag and confirm the other value is preserved (merge):
./bin/glab df configure npm \
  --repo-resolve https://gitlab.com/api/v4/projects/99/packages/npm/
cat .gitlab/df/config.json   # repoDeploy still points at project 42

# Argument and flag validation:
./bin/glab df configure cargo --repo-resolve https://example.com/  # Invalid argument "cargo"
./bin/glab df configure npm                                        # at least one of the flags ... is required

# Render a summary from a hand-written log:
mkdir -p .gitlab/df
cat > .gitlab/df/ci-log.json <<'JSON'
{"command":"npm install","entries":[
  {"package":"lodash","version":"4.17.21","verdict":"blocked","status":403,
   "reason":"Package 'lodash' violates 'block-mit-npm' policy"},
  {"package":"left-pad","version":"1.3.0","verdict":"warning",
   "reason":"license review required"}
]}
JSON
./bin/glab df ci-summary; echo "exit=$?"
# "GitLab Dependency Firewall" header, a "2 issues found: 1 blocked, 1 warning"
# line, and a padded table with a red Blocked and a yellow Warning row.
# exit=3 because the log contains a blocked entry.

# Warnings only exits 0; an unreadable log exits 1:
./bin/glab df ci-summary   # after removing the blocked entry -> exit 0