Auto-discover and verify new gov dependencie

[haseebmalik18]

Summary

Adds the tooling to keep src/gov-dependencies.data.ts updated on its own instead of by hand. Depends on #126, merge that first since this builds on its data and logic split.

Changes

• Crawls an allowlist of federal GitHub and npm orgs and reads their repos' manifests and READMEs to find packages.
• Verifies each candidate two ways before trusting it: the package's registry metadata has to point at a repo in an allowlisted org, and that repo has to declare the package name in its package.json, pyproject.toml, or README
  install command.
• Pulls npm org listings as a second source. Packages under an agency's npm org are proven by npm's access controls, so they skip verification.
• Caches repos by last push time, so after the first run it only rechecks repos that actually changed.
• Only ever adds entries, never removes. Anything it can't verify is flagged for a maintainer to check instead of being added silently.
• Allowlist is 186 federal orgs, checked against CISA's official .gov registry and GSA's federal org list.

Notes

• The weekly workflow and CODEOWNERS reviewer auto-assignment come in a follow up PR
• Discovery is kept modular so the code-gov inventory can slot in as the data source in Phase 3.