feat: Show cooldown report for pinned version installs (#225)

* feat: Show cooldown report for pinned version installs

When a user installs a package with an explicit version (e.g.
npm install foo@1.2.3) and that version falls within the dependency
cooldown window, the cooldown block is now recorded and shown in the
report. Previously, the report only appeared when ALL versions of a
package were in cooldown (remaining == 0), causing pinned version
installs to fail with a confusing "version not found" error from the
package manager instead of a clear cooldown explanation.

Introduces InterceptorContext to carry per-execution data (pinned
versions) from the CLI command through the interceptor layer, keeping
it separate from long-lived dependencies like the analyzer and cache.

* fix: Normalize PyPI pinned version keys for cooldown lookup

CLI-provided package names (e.g. Flask_Cors) don't match the
URL-parsed form (flask-cors). Normalize keys once at construction
time so cooldown lookups match correctly.

* fix: Handle dots in PyPI package name normalization per PEP 503

denormalizePyPIPackageName already documented [-_.] replacement but
only handled underscores. Now also replaces dots with hyphens so
names like zope.interface match the URL-parsed form zope-interface.

* refactor: Extract shared cooldown stats recording into helper

Deduplicate identical stats-recording blocks from npm_cooldown.go
and pypi_cooldown.go into recordCooldownStats in cooldown.go.

* fix: Distinguish explicit version pins from auto-resolved versions

PyPI parsers resolve all packages to concrete versions (even without
a user-specified constraint), so HasVersion() was always true. Add
IsExplicitVersion to PackageInstallTarget, set it only when the user
provided an explicit constraint. Use it in proxy_flow.go to avoid
false pinned-version cooldown reports.

proxy/interceptors/factory.go

@@ -8,12 +8,20 @@ import (
 	"github.com/safedep/pmg/proxy"
 )
 
+// InterceptorContext carries per-execution data from the CLI command into
+// the interceptor layer. Unlike the factory's long-lived dependencies
+// (analyzer, cache, stats), this holds context specific to the current run.
+type InterceptorContext struct {
+	PinnedVersions map[string]string
+}
+
 // InterceptorFactory creates ecosystem-specific interceptors for the proxy
 type InterceptorFactory struct {
 	analyzer         analyzer.PackageVersionAnalyzer
 	cache            AnalysisCache
 	statsCollector   *AnalysisStatsCollector
 	confirmationChan chan *ConfirmationRequest
+	execContext      InterceptorContext
 }
 
 // NewInterceptorFactory creates a new interceptor factory with shared dependencies
@@ -22,12 +30,14 @@ func NewInterceptorFactory(
 	cache AnalysisCache,
 	statsCollector *AnalysisStatsCollector,
 	confirmationChan chan *ConfirmationRequest,
+	execContext InterceptorContext,
 ) *InterceptorFactory {
 	return &InterceptorFactory{
 		analyzer:         analyzer,
 		cache:            cache,
 		statsCollector:   statsCollector,
 		confirmationChan: confirmationChan,
+		execContext:      execContext,
 	}
 }
 
@@ -41,6 +51,7 @@ func (f *InterceptorFactory) CreateInterceptor(ecosystem packagev1.Ecosystem) (p
 			f.cache,
 			f.statsCollector,
 			f.confirmationChan,
+			f.execContext,
 		), nil
 
 	case packagev1.Ecosystem_ECOSYSTEM_PYPI:
@@ -49,6 +60,7 @@ func (f *InterceptorFactory) CreateInterceptor(ecosystem packagev1.Ecosystem) (p
 			f.cache,
 			f.statsCollector,
 			f.confirmationChan,
+			f.execContext,
 		), nil
 
 	default: