feat(cli): auto-detect embedded private packages [RED-862]

[sorccu]

Linear: RED-862

Stacked on #1435 — targets simo/red-855-embed-private-dep-tarballs and should be rebased/retargeted onto main once that PR merges. Note the test workflow only triggers on PRs targeting main/next/*, so CI checks will not run here until the retarget; the full unit suite (2013 tests) passes locally on this commit.

Adds automatic detection of private packages to embed in Playwright code bundles, complementing the explicit checks.embeddedPackages list from RED-855. Detection runs during deploy/test/pw-test, is enabled by default (checks.detectEmbeddedPackages, per-run --no-detect-embedded-packages, env CHECKLY_DETECT_EMBEDDED_PACKAGES), and fails soft: any detection problem degrades to a warning, never a failed run, while explicit embeddedPackages entries keep their strict, fatal guarantees.

Privacy model

Private package names never leave the machine unless explicitly opted in:

1. Zero-network proofs — a public recorded tarball URL, or a public effective registry, classifies a package without any traffic.
2. Scope mapping — @scope:registry pointing at a non-public registry ⇒ embed, no lookup (over-embedding is safe by the bundle contract).
3. Registry interrogation — remaining undecided packages are checked against the customer's own registry via the Sonatype Nexus REST API, using the .npmrc credentials: hosted ⇒ embed. A per-group source-repo visibility guard and a zero-hosted-repos guard prevent permission-filtered listings from minting unsound "public" verdicts; same-origin recorded sources that aren't Nexus-shaped are decided conservatively (hosted ⇒ embed, silence ⇒ still undecided).
4. Opt-in fallback — checks.detectEmbeddedPackagesFallback: "public-registry" allows an integrity diff against public npm for whatever remains undecided. This transmits those names, so it is off by default (skip + warning). Transmitted names yield durable cached verdicts, so a name never needs transmitting twice — including when a lookup fails mid-run (partial results are persisted).

Caching

Two levels in the CLI cache (node_modules/.cache/checkly, per-user dir as fallback): a detection summary keyed by lockfile bytes + registry config + credentials + explicit specs, and per-entry immutable integrity-proof verdicts. Degraded runs (skipped packages or a broken .npmrc, e.g. an unset ${VAR}) are never summary-cached, so problems keep warning until fixed. Warm runs make zero network requests.

Validated end-to-end against a real dockerized Nexus Repository CE instance: REST-based verdicts correct with zero public-registry traffic, scope tier fully offline, warm runs request-free.

Known follow-ups (minor, from review)

• No positive test pins the restAccessRemediable tags or the combined two-tier failure message.
• An unresolvable scope mapping produces one fail-soft download warning per package (plus the config-problem warning) instead of a single aggregate.
• A few small dedups (a thrice-spelled error predicate, the classifyEntries catch mirroring the tier decision below it).

🤖 Generated with Claude Code