Initial project scaffold: macOS package security audit tool

This commit establishes the foundation for a comprehensive security audit
tool for macOS developer machines. It audits all installed software,
detects vulnerabilities via OSV.dev, and provides Claude-powered
mitigation recommendations.

## Architecture

- System inventory collection (Homebrew, pip, npm, Go, Rust, apps)
- CVE scanning via OSV.dev API (no auth, unlimited rate limits)
- Claude integration (CLI or SDK) for mitigation analysis
- JSON + HTML report generation
- Full test suite (34+ tests, 7 benchmarks)
- Production-grade linting (11 linters via golangci-lint)
- Vulnerability scanning (govulncheck)
- GitHub Actions CI/CD pipeline

## Key Components

- cmd/audit/: CLI entry point
- internal/inventory/: System inventory parsing
- internal/security/: OSV.dev querying, Claude integration, audit logic
- internal/report/: JSON and HTML report generation
- scripts/collect-inventory.sh: Bash script for system enumeration

## MVP Features

- Homebrew package scanning
- Python/Node/Go/Rust ecosystem scanning
- CVSS-based severity filtering
- Claude-powered recommendations (update/replace/protect/monitor)
- Makefile automation (test, lint, vulnerability checks)
- Pre-commit hooks configuration

## Testing & Quality

- 34+ unit tests with table-driven patterns
- 7 benchmark tests for performance
- 11 configured linters (staticcheck, gosec, revive, etc.)
- Code coverage reporting
- GitHub Actions CI (tests on Go 1.22 & 1.23)
- Pre-commit hook framework

## Documentation

- README.md: Full feature and usage documentation
- QUICKSTART.md: 3-minute setup guide
- TESTING.md: Testing and code quality guide
- QA_SETUP.md: Analysis tooling reference
- DATA_SOURCES_SPEC.md: Vulnerability data source documentation

## Data Sources

- OSV.dev: Primary CVE database (1.8 day latency, no auth needed)
- GitHub Advisories: Supplement for maintainer-created advisories
- OpenSSF Scorecard: Trust signals (repo health/practices)
- Homebrew Formulae API: Package metadata
- CISA KEV: Active exploitation tracking

## Next Steps

Phase 1 (MVP): Complete and tested ✓
Phase 2 (planned): Third-party app scanning, VirusTotal integration
Phase 3 (planned): Historical monitoring, scheduled audits, webhooks

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+repos:
+  # Go formatting and linting
+  - repo: https://github.com/golangci/golangci-lint
+    rev: v1.55.2
+    hooks:
+      - id: golangci-lint
+        args: ['--timeout=5m']
+
+  # General file checks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: detect-private-key
+
+  # Go security
+  - repo: https://github.com/securego/gosec.git
+    rev: v2.18.2
+    hooks:
+      - id: gosec
+        args: ['-no-fail', '-fmt=json']
+        entry: gosec
+
+  # Spell checking (optional)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.2.6
+    hooks:
+      - id: codespell
+        args: ['--ignore-words-list=cve,goo']
+        exclude: '\.go$'