fix(roots): scan uv tool environments under cache

[ronheichman]

What

Baseline scans and broad deep roots now walk the uv environments in ~/.cache/uv. A deep scan walks them before the broad root. These are the environments-v* directories and each archive-v*/<id> environment that uvx, uv tool run, or uv run --with links from environments-v*/<interpreter>/<resolution>.

Bumblebee follows a link only when the link names a directory directly inside the same cache's archive-v*. It follows no other symlink below the home. Unlinked archive entries (unpacked wheels), the other uv caches, and neighboring .cache trees stay excluded. An explicit root inside environments-v* gets the user_package_root kind.

CI and releases now use the latest Go 1.26 patch. Go 1.25 has no fix for the crypto/tls, net/http, and net/textproto advisories that govulncheck reports, and Go 1.26.9 fixes them.

Why

The .cache exclude hid environments that run packages, so a listed PyPI package installed by uvx produced no finding. uv builds each uvx environment in archive-v0 and links it from environments-v2. The walker does not follow that link.

Tests

• A deep scan reports a listed package once, from a linked uvx environment, and this test fails without the change.
• The same package gives no finding from these near misses:
  • an unlinked archive entry
  • a link outside the archive bucket
  • a symlinked archive bucket
  • another .cache tree
• Root resolution sets user_package_root in baseline, orders uv roots before the broad deep root, and skips a symlinked ~/.cache/uv and non-versioned bucket names.

A baseline PyPI scan of a macOS host with cached uvx environments gives these results. The host has both relative and absolute environment links.

Measure	main	This branch
Linked uvx environments walked	0 of 518	518 of 518
Records from linked uvx environments	0	37,560
Records from environments-v*	0	2,492
Other records	1,764	1,764
Roots	18	537
Files considered	2.15M	5.00M

Every main record is still present on this branch.

Checks

gofmt -l .
go vet ./...
go test ./...
go test -race ./...
go build -buildvcs=false -o ./bumblebee ./cmd/bumblebee
./bumblebee selftest
govulncheck ./...

These checks pass with Go 1.26.9, and govulncheck v1.3.0 finds no vulnerabilities.

Gaps

• Bumblebee does not look for uv caches set by UV_CACHE_DIR, --cache-dir, or XDG_CACHE_HOME, or for the legacy macOS cache ~/Library/Caches/uv.
• Baseline does not cover uv tool install environments in ~/.local/share/uv/tools, which uvx also reuses, but a deep scan of the home walks them.
• go.mod and the docs still allow Go 1.25 builds, which lack the standard-library fixes.
• A cached environment shows exposure, not execution.

[ronheichman]

Recreated as #85 at unchanged commit 010d061ee62590da25502cd06333f2837ca5b81d on an upstream branch. Closing this fork-based PR to retire ronheichman/bumblebee. Original discussion and approvals remain here; approvals do not transfer.

Built with Pi.