feat: Manifest parsing with --from flag

[rdwj]

Problem

veripak currently accepts a single package per invocation. To audit a project's dependencies, users must manually extract package names from manifest files and run veripak check once per package. The discover skill integration (and general CLI usability) requires automatic dependency extraction.

Proposed Solution

Add a --from flag to veripak check that accepts a manifest file path:

veripak check --from requirements.txt
veripak check --from pom.xml
veripak check --from pyproject.toml
veripak check --from package.json

Behavior

• Parse the manifest to extract (package, version, ecosystem) tuples
• Ecosystem is inferred from the manifest type (requirements.txt → python, pom.xml → java, etc.)
• Run the audit pipeline for each package (leveraging batch engine from Issue feat: Add batch processing for multiple packages #2)
• Output: array of audit results (JSON mode) or sequential human-readable output

Manifest Formats to Support (initial)

Manifest	Ecosystem	Parser complexity
requirements.txt	python	Low — line-per-package, strip extras/markers
pyproject.toml	python	Medium — TOML parsing, multiple dependency keys
pom.xml	java	Medium — XML parsing, <dependencies> section
package.json	javascript	Low — JSON, dependencies + devDependencies

Dependencies

• Requires Issue feat: Add batch processing for multiple packages #2 (batch engine) for efficient multi-package execution
• Requires thread safety fixes (Issue fix: Thread safety for batch-mode prerequisites #25) as prerequisite

Complexity

Medium-high. Requires parsers for 4+ formats, integration with batch engine, and CLI changes.