[Phase 1] Platform scaffold: workspace, DB schema, Alembic, runner, errors

[varun-polpakkara]

Summary

Foundation step — everything needed for a working Python workspace, database, and skeleton packages.

What was built

• cyberguard/pyproject.toml — uv workspace root with packages/* members. Dev deps (pytest, ruff, mypy) at root; runtime deps per package.
• runner.py — Single subprocess gateway. All external tool invocations (Syft, Grype, OSV-Scanner, OpenGrep, CodeQL) go through run_tool(command, *, cwd, timeout_seconds, env_overrides) -> ToolResult. No stage may call subprocess.run directly. This is what makes the entire unit test strategy possible: mock run_tool, never install real tools in unit tests.
• errors.py — Typed exception hierarchy: PipelineError -> PipelineStageError -> SBOMGenerationError | CVEMatchingError | ReachabilityAnalysisError | ExploitEnrichmentError | ReportGenerationError.
• db/models.py — Full SQLAlchemy ORM with all 7 tables and 4 enums (Severity, ReachabilityStatus, ExploitAvailability, TriageStatus).
• db/session.py — make_engine(url) factory and get_session() context manager.
• Alembic migrations — Two versions: initial schema + follow-up adding NEGLIGIBLE severity level.
• domain-engine stub — Exports DomainSelector, DomainType, StandardsMapper. Satisfies test_domain_engine.py.
• risk-engine stub — Exports contextual_risk_score. Satisfies test_risk_engine.py.

Verify

• uv sync succeeds
• alembic upgrade head creates all 7 tables
• All existing unit tests pass