feat(runner): support user-defined scanners (BYOS) in profile config

[jesse-merhi]

What this enables

ClawScan runs a fixed set of built-in scanners. This PR lets a profile config
declare its own scanner — an ID plus a shell command — which ClawScan runs
and whose raw JSON stdout it preserves as evidence, exactly like a built-in
adapter. This is "Bring Your Own Scanner" (BYOS).

A profile scanner used to be a name only. It can now also be an object:

version: 1
profiles:
  semgrep-demo:
    scanners:
      - clawscan-static          # unchanged: a built-in, by name
      - id: semgrep              # new: a user-defined scanner
        command: semgrep --json --config ./rules.yml {{target}}
        targets: [skill]         # optional; defaults to [skill, url]
        env: [SEMGREP_APP_TOKEN] # optional; declared up front, recorded as presence only

{{target}} is substituted with the scan target at run time.

Reviewer-checkable proof

With this branch checked out and semgrep on your PATH, paste this to see a
custom scanner run end to end (creates its own temp files, touches nothing in
the repo):

D=$(mktemp -d); mkdir -p "$D/skills/demo-skill"
cat > "$D/rules.yml" <<'YAML'
rules:
  - id: python-eval-use
    languages: [python]
    severity: ERROR
    message: Use of eval() on untrusted input is dangerous.
    pattern: eval(...)
YAML
cat > "$D/.clawscan.yml" <<YAML
version: 1
profiles:
  semgrep-demo:
    scanners:
      - id: semgrep
        command: semgrep --json --config $D/rules.yml {{target}}
        targets: [skill]
YAML
printf 'def run(x):\n    return eval(x)\n'  > "$D/skills/demo-skill/handler_bad.py"  # flagged
printf 'def run(x):\n    return int(x)\n'   > "$D/skills/demo-skill/handler_ok.py"   # clean
printf '# Demo Skill\n'                     > "$D/skills/demo-skill/SKILL.md"

go run ./cmd/clawscan "$D/skills/demo-skill" \
  --profile semgrep-demo --config "$D/.clawscan.yml" --sandbox off --json 2>/dev/null \
| jq '{status: .scanners.semgrep.status,
       findings: (.scanners.semgrep.raw.results | length),
       flagged: [.scanners.semgrep.raw.results[] | (.path|split("/")|last)]}'

Expected — the risky file is flagged, the clean file is not, and semgrep's own
JSON is preserved untouched:

{
  "status": "completed",
  "findings": 1,
  "flagged": ["handler_bad.py"]
}

Two contract checks worth doing while you're here:

• Evidence contract: remove --json from the command: line and rerun —
  semgrep prints plain text, and the scanner result flips to failed
  ("returned invalid JSON"). Raw evidence must be JSON.
• Target injection safety: the recorded scanners.semgrep.command shows
  ["/bin/sh","-c","semgrep ... \"$1\"","clawscan-target","<target>"]. The
  target is passed as a positional argument, never spliced into the command
  string, so target paths with spaces or shell metacharacters can't break out.

How it works (the seam)

• Parse (internal/profiles/resolver.go): ProfileScanner.UnmarshalYAML
  accepts a scalar (built-in name) or a mapping ({id, command, env, targets},
  marked custom).
• Build registry (resolver.go: profileScannerRegistry): each custom entry
  becomes a NewUserDefinedScanner adapter appended to the default registry via
  ScannerRegistry.WithAdapters.
• Thread it (internal/runner/runner.go): a new Options.ScannerRegistry
  field carries that registry; registryForOptions(opts) returns it (or the
  default), so ID validation and target-kind checks see custom scanners.
• Run (internal/runner/user_defined_scanner.go: Run): renders {{target}},
  runs through the sandbox shell (Docker→linux image, else host), and turns
  stdout into a ScannerResult under the JSON contract above.

Scope

Stacked series; this is the base. Review this diff against main.

• Deferred to later PRs (by design, not missing): the install gate
  (--gate) is feat(runner): evaluate exit-code install-gate policy into artifact verdict #24, and the security hardening for user-defined scanners is a
  stacked series sec (1/9): restrict user-defined scanner IDs to lowercase #25–sec (9/9): document that scanners must not print secrets into raw evidence #33 (sec 1–9 of 9): scanner-ID canonicalization
  (sec (1/9): restrict user-defined scanner IDs to lowercase #25), env: bare-name validation (sec (2/9): reject inline env values in user-defined scanners #26), required active {{target}} (sec (3/9): require an active {{target}} in user-defined scanners #27),
  benchmark preflight scoping (sec (4/9): scope benchmark requirement preflight to runnable scanners #28), Windows target guard (sec (5/9): reject unsafe targets on the Windows host shell #29), cwd isolation
  (sec (6/9): run user-defined scanners in an isolated working directory #30), declared-env redaction (sec (7/9): redact declared scanner env values from error text #31), explicit sandbox mounts (sec (8/9): replace writable-parent mount guess with explicit sandbox mounts #32), and the
  raw-evidence secret-safety contract (sec (9/9): document that scanners must not print secrets into raw evidence #33).
• Merge order: main → #23 → #24 → #25 … #33. This base
  should not land on main ahead of that hardening stack.

Verification

gofmt -l internal/ cmd/          # clean
go build ./...                   # ok
go vet ./...                     # clean
GOOS=windows go build ./...      # ok
go test -count=1 ./...           # ok, except 2 pre-existing macOS /var-symlink
                                 # failures in internal/runner/target_test.go
                                 # (unrelated to this PR; environmental)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(runner): support user-defined scanners (BYOS) in profile config This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.