feat: add uvx (uv tool run) package executor (#357)

* feat(uvx): add uvx (uv tool run) package executor

Adds support for `uvx`, implemented as a PyPI Executor alongside pipx.
uvx is an alias for `uv tool run`: it installs a tool into an ephemeral
environment and runs it, so it has no install/list subcommand and the
first positional argument (or --from) is the package to audit.

Parsing highlights:
- --from overrides the positional command as the package to audit
- --with packages are audited as additional environment dependencies
- name@version shorthand (ruff@0.3.0, ruff@latest) is normalized
- flag parsing stops at the tool name so the tool's own flags are not
  misread as uvx options; uvx's value/boolean flags are registered so
  none greedily consume the package positional
- VCS/URL/local-path specs are skipped for registry auditing

Wires up command registration, analytics, shell alias/shim, cloud audit
mapping, a dedicated `uvx` sandbox profile (UV_*/PIP_* env, uv cache and
tool dirs), config policy, docs, unit tests and an E2E workflow step.

Closes #326

https://claude.ai/code/session_011hyLxq7oWJX5Dp4tCEfG19

* chore(uvx): align docs and base profile with uvx support

Incorporates the low-risk, non-parser improvements from the community
PR #345 (author non-responsive) into our implementation:

- list uvx (and the previously-missing pipx) as PyPI managers in the
  pypi-restrictive base profile package_managers and its README, so the
  base profile applies directly when selected via --sandbox-profile
- document uvx in docs/github-action.md and docs/proxy-mode.md
- add version / IsExplicitVersion assertions to the uvx parser tests

Our pflag-based parser is kept as-is: unlike #345 it audits --with
packages and handles all uvx short flags (e.g. -w), both of which the
community PR misses.

* fix(uvx): skip interpreter requests; use require in tests

Addresses review feedback on PR #357:

- uvx interpreter requests (`uvx python`, `uvx python@3.12`, `uvx pypy`,
  ...) launch an isolated interpreter rather than installing a PyPI tool.
  Treating the positional as a package made the guard flow resolve/analyze
  pkg:pypi/python (and python==3.12), which could wrongly block or fail a
  valid invocation. Skip these for the positional; --with packages on the
  same command are still audited.
- Use require.NoError / require.Len for fatal assertions in the uvx tests,
  matching the repo's testing convention, so a failure stops the subtest
  before a nil dereference instead of panicking.

* docs(uvx): document fail-open and --with-requirements trade-offs

Record the two deliberate parsing decisions raised in review as in-code
trade-off comments (no behavior change):

- unknown flags are tolerated (fail open), consistent with the other
  executors; the residual gap only affects non-proxy guard mode since the
  default proxy flow intercepts every registry download.
- --with-requirements / --with-editable values are consumed but not
  expanded into audit targets; expanding them needs manifest-extractor and
  guard changes, tracked as follow-up. Proxy mode still covers them.

* docs(uvx): drop --with-requirements limitation note

Per maintainer review: guard mode is being deprecated and auditing the
contents of an existing requirements file is a scanner's responsibility,
not PMG's. Remove the "known limitation / follow-up" note; the flags stay
registered only so their values are not mistaken for the tool positional.

---------

Co-authored-by: Claude <noreply@anthropic.com>

sandbox/profiles/README.md

@@ -10,7 +10,7 @@ Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).
 
 ### pypi-restrictive
 
-Restrictive policy for the PyPI ecosystem (pip, pip3, poetry, uv).
+Restrictive policy for the PyPI ecosystem (pip, pip3, pipx, poetry, uv, uvx).
 
 ## Custom Policies
 

sandbox/profiles/pypi-restrictive.yml

@@ -6,6 +6,7 @@ package_managers:
   - pipx
   - poetry
   - uv
+  - uvx
 
 # Optional security settings (uncomment to enable)
 # allow_git_config: false  # Allow package managers to modify .git/config (default: false, blocks for security)

sandbox/profiles/uvx.yml

@@ -0,0 +1,55 @@
+name: uvx
+description: Profile for uvx executor (uv tool run) with write access to current directory
+inherits: pypi-restrictive
+
+package_managers:
+  - uvx
+
+# uvx runs tools in ephemeral environments and often needs PTY access, e.g.
+# `uvx cowsay -t hello`. Set explicitly so it stays enabled even if a parent
+# profile turns it off in the future.
+allow_pty: true
+
+# uvx-executed tools may need to bind to localhost ports (e.g. dev servers).
+allow_network_bind: true
+
+environment:
+  # The pypi-restrictive base allows no environment variables. uvx is driven by
+  # uv, so it needs uv's own config namespace (UV_*) and honors pip's index/TLS
+  # conventions (PIP_*). Sibling tool credentials (POETRY_*) and TWINE_* stay
+  # scrubbed.
+  #
+  # Accepted trade-off: UV_* re-allows UV_PUBLISH_TOKEN, uv's publishing
+  # credential, even though uvx does not publish.
+  allow:
+    - UV_*
+    - PIP_*
+
+filesystem:
+  allow_read:
+    # uv cache: ephemeral tool environments are created here. ~/.cache/uv is the
+    # Linux default; uv honors UV_CACHE_DIR / XDG_CACHE_HOME otherwise.
+    - ${HOME}/.cache/uv/**
+    - ${HOME}/Library/Caches/uv/**
+
+    # uv data dir: managed Python interpreters and installed tools.
+    - ${HOME}/.local/share/uv/**
+    - ${HOME}/Library/Application Support/uv/**
+
+    # uv config and the tool bin directory.
+    - ${HOME}/.config/uv/**
+    - ${HOME}/.local/bin/**
+
+  allow_write:
+    - ${CWD}/**
+    - ${HOME}/.cache/uv/**
+    - ${HOME}/Library/Caches/uv/**
+    - ${HOME}/.local/share/uv/**
+    - ${HOME}/Library/Application Support/uv/**
+    - ${HOME}/.config/uv/**
+    - ${HOME}/.local/bin/**
+
+  # Additional deny rules for extra security
+  deny_write:
+    - ${CWD}/.env
+    - ${CWD}/.env.*