Add Go package risk aggregation

[rdzehtsiar]

Motivation

• Provide package-level aggregation so Go repositories have aggregated risk signals in addition to file-level rows for easier hotspot triage.
• Materialize package risk deterministically from scored Go files in the same repository-relative directory to give approximate package-level insights without full build metadata.

Description

• Add new schema tables package_risk_scores, package_risk_terms, and package_risk_facts in src/pipeline/store_reducer.rs and corresponding indexes.
• Implement materialize_package_risk_scores which groups file_risk_scores joined with file_facts by package_path, accumulates file counts, scores, churn, complexity, and source-coupling, computes aggregate terms (max, mean, top-3 mean, file count, source coupling) and writes package-level score, terms, and facts.
• Wire package materialization into the finalization pipeline by calling materialize_package_risk_scores(&transaction)?; before materialize_project_risk_summary.
• Add helper code and constants (PACKAGE_RISK_FORMULA_ID, weighting constants, package_risk_row, package_risk_term, normalized_package_value, package_risk_band, and accumulator structs) and update initialize_database to create the new tables.
• Add integration test scan_materializes_go_package_risk_scores in tests/scanner_cli.rs and extend existing store reducer schema test to assert presence of package tables, and update README.md to document package-level risk behavior.

Testing

• Ran formatting and linters with cargo fmt --check and cargo clippy --all-targets --all-features -- -D warnings, and both completed successfully.
• Executed the full test suite with cargo test and all tests passed, including the new integration test scan_materializes_go_package_risk_scores (unit tests: 95 passed; scanner CLI tests: 8 passed).
• Verified the new package materialization logic via the added test which asserts table row counts, stage metadata keys package_risk_formula_id and package_risk_scores_materialized, per-package file counts, source coupling aggregation, and a positive package score.

---

Codex Task

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 92.77108% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/pipeline/store_reducer.rs	92.77%	3 Missing and 21 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
99.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Qodana for Rust

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions