New IaC type: Pulumi scanner

[alphacrack]

Summary

Add a new IaC type: Pulumi (TypeScript/Python) scanner, plugging into the existing factory the same way Terraform and CDK do.

Context

The scanner dispatch is a real factory: src/iac_scanner/factory.py → create_scanner(path) picks a scanner subclass of IacScanner (scanners/base.py) based on each scanner's can_handle classmethod. Per CLAUDE.md: "adding a new IaC type means a new scanner + factory entry, nothing else."

What to build

• scanners/pulumi.py with a PulumiScanner(IacScanner):
  • can_handle(path) — detect Pulumi.yaml + an index.ts/__main__.py entrypoint.
  • scan() — load entry file(s), apply the shared filters (skip-list, redaction, size cap from _filters.py), return a ScanResult.
• Register it in the factory.
• A samples/pulumi/ sample.
• Tests mirroring test_factory_and_scan.py.

Acceptance criteria

• iac-scan scan ./samples/pulumi --scan-only detects iac_type == "pulumi".
• Shared filters applied (no bypass).
• Factory + scanner + sample + tests included.

Notes

Meaty but self-contained — the factory pattern makes it additive. Good for someone who wants a substantial first-or-second contribution. area:scanners, type:feature. Read the two existing scanners first.