feat(safegres): configurable rules, presets, config-driven scoring, doctor + print-config

[pyramation]

Summary

Makes safegres configurable like a linter (design: constructive-io/constructive-planning#1282), on top of the new confstash loader (constructive-io/dev-utils#97).

Depends on publishing confstash to npm — packages/safegres now depends on confstash@^0.0.1, so pnpm install (and CI) will fail until constructive-io/dev-utils#97 is merged and published. Tested locally against a packed confstash tarball; the lockfile is intentionally untouched and should be regenerated after publish.

• Rule registry (src/rules/registry.ts): metadata for A1–A7, P1, P1b, P5 (defaultSeverity, category, scope: 'table' | 'policy-ast') with prefix-wildcard selectors ('P*').
• Config (src/config/*): SafegresConfig — extends, rules: { CODE: 'off' | severity | [severity, options] }, per-table overrides: [{ tables: ['public.audit_*'], rules }] (glob on schema.table), scoring, failOn. Discovered via confstash (safegres.config.{ts,js,mjs,cjs}, .safegresrc*, safegres.json, package.json "safegres"). Exact codes beat wildcards; unknown codes/severities throw ConfigValidationError.
• Presets: safegres:recommended (today's behavior), strict, multi-tenant, minimal — just partial configs, chainable via extends.
• Config-driven scoring (src/score/score.ts): weighted deductions (critical 25 / high 10 / medium 4 / low 1 / info 0), per-rule cap (40), grade bands A+→F, criticals floor the grade at C — all tunable via scoring. Report.score = { value, grade, deductions }; rendered in pretty output.
• audit(): takes config?: SafegresConfig; findings are filtered/restamped by resolved rules (respecting per-table overrides), AST work is skipped when every policy-ast rule is off, and schemas/roles fall back to config values.
• New CLI: safegres doctor (config discovery + rule validation, pgsql-parser availability, connection, pg_policy access, BYPASSRLS blind spots, any-RLS-tables check; exit 1 on FAIL), safegres print-config [--explain], plus --config / --preset / --rule CODE=setting / --fail-on-score / --fail-on-grade on audit.

Behavior without a config file is unchanged (all rules at default severities), except reports now include a score.

Tests: 37 passing (21 new in __tests__/config.test.ts); CLI smoke-tested (doctor, print-config --preset minimal, audit) against postgres-plus:18.

Link to Devin session: https://app.devin.ai/sessions/671aac6e50b04e8caacd3f54c1c63bc6
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring