feat(enrichment): IaC & config misconfiguration auditor

[JSONbored]

Context

A REES (review-enrichment service) analyzer. Tier: solid.

Detects: Security misconfigs in changed infra/config: wildcard CORS+credentials, 0.0.0.0/0 ingress, public buckets, sameSite:none / secure:false cookies, rejectUnauthorized:false / verify=False, prod debug-on, hardcoded URLs where an env var belongs. file:line.

Data source: Bundled Checkov/KICS (or tfsec/hadolint) ruleset over changed .tf/.yaml/Dockerfile/compose/nginx/k8s/app-config. Pure static, no network.

This is heavy/external/historical analysis the no-checkout headless claude --print reviewer cannot do; the REES returns it as a brief block the engine splices into the review (additive + fail-safe).

Implementation (established pattern, all inside review-enrichment/)

1. Finding type + BriefFindings key in src/types.ts
2. src/analyzers/<name>.ts — pure, inject fetch for tests
3. Register in src/brief.ts ANALYZERS registry
4. Render a public-safe block in src/render.ts
5. node:test units against dist/ + a live smoke against the real data source

Deliverables

• The analyzer + wiring + tests + a verifiable brief block (file:line or package@version)
• Clean PR off main (zero engine conflict; outside the engine tsc/vitest/codecov scope)

Parent: #1499