Feat/hermetic build v0.2

[AadarshLN]

Summary

RE-02.01 (HermeticBuild) previously used a narrow v0.1 grep against only GitHub Actions workflows. This PR broadens the heuristic to v0.2:

• Broader scan surface: GitHub Actions workflows, composite actions (.github/actions//), GitLab CI, CircleCI, Jenkinsfile, Azure Pipelines, Drone, Buildkite, Makefiles, build scripts (scripts/build, scripts/install*), Dockerfiles, and Containerfiles
• Comment stripping: Shell/YAML comments are stripped before pattern matching to eliminate false positives (e.g. curl in a comment)
• Dockerfile DEFERRED: apt-get install, apk add, etc. inside a Dockerfile are classified as DEFERRED — building the image environment is acceptable; fetching app deps at build time is not
• Strong hermeticity signals: Witness runtime attestation, Nix flake + CI, and Bazel network sandbox short-circuit to PASS when detected
• INCONCLUSIVE by default: A clean grep alone is no longer PASS — absence of violations is not proof of hermeticity (confidence 0.4)

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

If this PR modifies the darnit framework (packages/darnit/):

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Control/TOML Changes Checklist

If this PR modifies controls or TOML configuration:

• Control metadata defined in TOML (not Python code)
• SARIF fields (description, severity, help_url) included where appropriate
• Ran validation to confirm TOML schema compliance

Testing

• Tests pass locally (uv run pytest tests/ -v)
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

Additional Notes