feat: add slopsquatscan crate — Rust package supply chain scanner

[remigius-labs]

Summary

Adds slopsquatscan as a standalone Rust crate in the workspace — a CLI tool that scans installed packages for slopsquatting (AI-hallucinated package names registered by attackers).

What it checks:

• npm (global), pip, and AUR packages
• Flags packages NOT FOUND on their registry (suspicious)
• Flags packages with very low downloads (<100/week) or newly published (<30 days)

Usage:

slopsquatscan              # scan all (npm + pip + AUR)
slopsquatscan --npm        # npm only
slopsquatscan --verbose    # show clean packages too
slopsquatscan --json       # machine-readable output

Changes

• New crate: crates/slopsquatscan/ (3 source files, ~660 lines)
• Added to workspace members in root Cargo.toml
• No changes to existing tirith code

Structure

crates/slopsquatscan/
├── Cargo.toml
└── src/
    ├── main.rs        # CLI entry, orchestration, summary
    ├── registry.rs    # npm/pypi/aur registry checks via reqwest
    └── output.rs      # colored terminal output

Test plan

• cargo build -p slopsquatscan — compiles clean
• cargo clippy -p slopsquatscan -- -D warnings — zero warnings
• cargo build — full workspace builds without breakage
• Smoke tested --aur --verbose on Arch Linux
• Release build: 4.1 MB binary

🤖 Generated with Claude Code