feat: advisory message appended to block output (#362)

* docs(specs): add custom block messages and package blocklist spec

* docs(specs): add custom block messages and package blocklist implementation plan

* feat(config): add blocked_packages list and custom block messages

* feat(audit): add package_blocklist_blocked event and blocklist model

* feat(proxy): block blocklisted packages in the policy gate before analysis

* feat(guard): block blocklisted packages before trust skip and analysis

* feat(ui): render blocklist blocks and custom messages, fix silent-mode block output

* feat(proxy): append custom messages to malware and go-cooldown block bodies

* test(proxye2e): cover blocklist enforcement and custom block messages

* docs(specs): remove spec and plan documents

* refactor: drop guard-flow blocklist enforcement and trim docs

Guard mode is being deprecated; the blocklist is enforced in proxy mode
only. Remove the trusted_packages mirroring references outside the docs.

* refactor(config): consolidate blocklist and block message under top-level block section

Replace dependency_cooldown.message, malware.message and blocked_packages
with a single block section: block.message is appended to every block
output regardless of which control blocked, and block.packages is the
package blocklist.

* fix(ui): render block.message as info note with clean spacing

* fix(ui): indent wrapped continuation lines in block reasons and messages

* update config template

* refactor(config): replace block section with top-level advisory_message

Remove the package blocklist (will be implemented as part of policies in
the future) and replace block.message with an optional top-level
advisory_message appended to every block output.

* chore(config): move advisory_message near top-level scalar configs in template

internal/ui/report.go

@@ -82,6 +82,10 @@ type ReportData struct {
 	// Packages blocked by the dependency cooldown policy (proxy mode only)
 	CooldownBlockedPackages []models.CooldownBlock
 
+	// AdvisoryMessage is the optional org-configured message appended to block
+	// output regardless of which control blocked. Set from advisory_message.
+	AdvisoryMessage string
+
 	// Configuration context
 	FlowType          FlowType
 	DryRun            bool
@@ -135,10 +139,27 @@ func Report(data *ReportData) {
 	}
 }
 
-// reportSilent only shows output on errors or blocks
-// Normal successful execution produces no output
+func printMalwareBlockSection(data *ReportData) {
+	if len(data.BlockedPackages) == 0 {
+		return
+	}
+
+	fmt.Println()
+	fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red("Malicious package blocked"))
+	printMaliciousPackagesList(data.BlockedPackages)
+	fmt.Println()
+}
+
+// reportSilent shows output only when the install was blocked: silent mode
+// hides PMG except for errors and malicious package detection. Cooldown-only
+// blocks stay hidden, matching the documented silent contract.
 func reportSilent(data *ReportData) {
-	// Silent mode: no report output
+	if data.Outcome != OutcomeBlocked || len(data.BlockedPackages) == 0 {
+		return
+	}
+
+	printMalwareBlockSection(data)
+	printAdvisoryMessage(data.AdvisoryMessage)
 }
 
 // reportNormal shows minimal, assuring output
@@ -176,12 +197,7 @@ func reportNormal(data *ReportData) {
 
 	switch data.Outcome {
 	case OutcomeBlocked:
-		if len(data.BlockedPackages) > 0 {
-			fmt.Println()
-			fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red("Malicious package blocked"))
-			printMaliciousPackagesList(data.BlockedPackages)
-			fmt.Println()
-		}
+		printMalwareBlockSection(data)
 
 		if len(data.CooldownBlockedPackages) > 0 {
 			fmt.Println()
@@ -193,6 +209,11 @@ func reportNormal(data *ReportData) {
 			fmt.Println()
 		}
 
+		if data.AdvisoryMessage != "" {
+			printAdvisoryMessage(data.AdvisoryMessage)
+			fmt.Println()
+		}
+
 		onlyCooldown := len(data.BlockedPackages) == 0 && len(data.CooldownBlockedPackages) > 0
 		if onlyCooldown {
 			icon = Colors.Yellow("⊘")
@@ -307,6 +328,11 @@ func reportVerbose(data *ReportData) {
 		}
 	}
 
+	if data.Outcome == OutcomeBlocked && data.AdvisoryMessage != "" {
+		fmt.Println()
+		printAdvisoryMessage(data.AdvisoryMessage)
+	}
+
 	fmt.Println()
 }