feat: support importing provisioners from a local directory

[Copilot]

Ports score-compose#465 — replaces uriget.GetFile with uriget.GetFiles in the init command's provisioner loading path.

Changes

• internal/command/init.go: Replace single-file uriget.GetFile call with uriget.GetFiles, iterating over the returned []FileContent slice. Each file's .URI is used as the save filename; stdin (-) still maps to from-stdin.provisioners.yaml.

Result

Users can now pass a directory to --provisioners and all files within are imported in sorted order:

# Before: each file specified individually
score-radius init \
  --provisioners ./provisioners/10-redis.provisioners.yaml \
  --provisioners ./provisioners/20-service.provisioners.yaml

# After: whole directory at once
score-radius init --provisioners ./provisioners/

Single file paths and remote URIs continue to work unchanged. No go.mod bump required — score-go v1.16.0 (already in use) includes GetFiles.

[mathieu-benoit]

LGTM

[github-actions]

Overview

Image reference	score-radius:latest	score-radius:latest
- digest	b5599efb8191	341db3e4a126
- tag	latest	latest
- provenance	60ffaaf	0e187f9
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	5.4 MB	5.4 MB (+2.2 kB)
- packages	40	40

Policies (0 improved, 0 worsened)

Policy Name	score-radius:latest	score-radius:latest	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change
Valid Docker Hardened Image (DHI) or DHI base image	⚠️ 2	⚠️ 2		No Change

Packages and Vulnerabilities (1 package changes and 0 vulnerability changes)

• ♾️ 1 packages changed
• 39 packages unchanged

Changes for packages of type golang (1 changes)

	Package	Version score-radius:latest	Version score-radius:latest
♾️	github.com/score-spec/score-radius	0.0.0-20260418032016-60ffaafed00a+dirty	0.0.13-0.20260418033001-0e187f91a72c+dirty

[mathieu-benoit]

FYI: associated doc updated accordingly #75