feat: advisory message appended to block output (#362)

* docs(specs): add custom block messages and package blocklist spec

* docs(specs): add custom block messages and package blocklist implementation plan

* feat(config): add blocked_packages list and custom block messages

* feat(audit): add package_blocklist_blocked event and blocklist model

* feat(proxy): block blocklisted packages in the policy gate before analysis

* feat(guard): block blocklisted packages before trust skip and analysis

* feat(ui): render blocklist blocks and custom messages, fix silent-mode block output

* feat(proxy): append custom messages to malware and go-cooldown block bodies

* test(proxye2e): cover blocklist enforcement and custom block messages

* docs(specs): remove spec and plan documents

* refactor: drop guard-flow blocklist enforcement and trim docs

Guard mode is being deprecated; the blocklist is enforced in proxy mode
only. Remove the trusted_packages mirroring references outside the docs.

* refactor(config): consolidate blocklist and block message under top-level block section

Replace dependency_cooldown.message, malware.message and blocked_packages
with a single block section: block.message is appended to every block
output regardless of which control blocked, and block.packages is the
package blocklist.

* fix(ui): render block.message as info note with clean spacing

* fix(ui): indent wrapped continuation lines in block reasons and messages

* update config template

* refactor(config): replace block section with top-level advisory_message

Remove the package blocklist (will be implemented as part of policies in
the future) and replace block.message with an optional top-level
advisory_message appended to every block output.

* chore(config): move advisory_message near top-level scalar configs in template

config/config.go

@@ -10,7 +10,6 @@ import (
 
 	_ "embed"
 
-	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
 	"github.com/safedep/dry/log"
 	"github.com/safedep/dry/usefulerror"
 	"github.com/safedep/dry/utils"
@@ -82,6 +81,10 @@ type Config struct {
 	// TrustedPackages allows for trusting a suspicious package and ignoring the suspicious behaviour for the package in future installations
 	TrustedPackages []TrustedPackage `mapstructure:"trusted_packages"`
 
+	// AdvisoryMessage is an optional org-specific message appended to every
+	// block output, regardless of which control blocked the installation.
+	AdvisoryMessage string `mapstructure:"advisory_message"`
+
 	// SkipEventLogging allows for skipping event logging.
 	SkipEventLogging bool `mapstructure:"skip_event_logging"`
 
@@ -289,12 +292,7 @@ type TrustedPackage struct {
 	Purl   string `mapstructure:"purl"`
 	Reason string `mapstructure:"reason"`
 
-	// Pre-parsed PURL components (not serialized, computed at load time)
-	// These fields avoid repeated PURL parsing on every IsTrustedPackage() call
-	parsed    bool
-	ecosystem packagev1.Ecosystem
-	name      string
-	version   string
+	purlRef
 }
 
 // RuntimeConfig is the configuration that is used at runtime. It contains static configuration
@@ -468,6 +466,7 @@ func DefaultConfig() RuntimeConfig {
 			EventLogRetentionDays:  7,
 			SkipEventLogging:       false,
 			TrustedPackages:        []TrustedPackage{},
+			AdvisoryMessage:        "",
 			ProxyMode:              true,
 			Verbosity:              VerbosityNormal,
 			Sandbox: SandboxConfig{
@@ -596,8 +595,8 @@ func initConfig() {
 
 	loadConfig()
 
-	if err := preprocessTrustedPackages(&globalConfig.Config); err != nil {
-		log.Warnf("Failed to preprocess trusted packages: %v", err)
+	if err := preprocessPackageRefs(&globalConfig.Config); err != nil {
+		log.Warnf("Failed to preprocess package refs: %v", err)
 	}
 }