feat(cooldown): add dependency_cooldown.skip list (per-control exemption) (#328)

Let dependency cooldown respect an explicit skip list so first-party /
internal packages that must be installed the moment they are published
(e.g. to sanity-test a freshly released version) are not held back by the
cooldown window.

Per review, this is a per-control skip list — NOT a second definition of
"trusted package". There remains a single top-level `trusted_packages`
(which waives malware analysis); `dependency_cooldown.skip` waives ONLY
the cooldown wait, so a fast-tracked package is still malware-scanned.

Matching:
- a PURL without a version skips cooldown for all versions of the package
  (package-level) — the metadata passes through unmodified;
- a PURL with a version skips cooldown for that version only — that
  version is preserved during stripping while other recent versions are
  still held.

- config: DependencyCooldownConfig.Skip + CooldownSkip()/CooldownSkipInfo.
- npm/pypi interceptors: bypass on package-level skip; thread per-version
  exemptions into the cooldown stripper so pinned versions survive.
- docs + config template; unit tests for the matcher (package/version
  level, precedence, mismatches) and the skip-vs-trusted independence.

Signed-off-by: dmdhrumilmistry <56185972+dmdhrumilmistry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

config/config.go

@@ -148,6 +148,17 @@ type SandboxConfig struct {
 type DependencyCooldownConfig struct {
 	Enabled bool `mapstructure:"enabled"`
 	Days    int  `mapstructure:"days"`
+
+	// Skip is a per-control skip list of packages exempt from the cooldown
+	// window. It is independent of the top-level trusted_packages: it waives ONLY
+	// the cooldown wait, never malware analysis, so a fast-tracked package is
+	// still scanned. Intended for first-party / internal packages that must be
+	// installed immediately on release.
+	//
+	// Matching: a PURL without a version skips cooldown for ALL versions of the
+	// package (package-level); a PURL with a version skips cooldown for that
+	// version only (version-level).
+	Skip []TrustedPackage `mapstructure:"skip"`
 }
 
 // legacyProfileAliases maps old default profile names, keyed by package