feat: GoThirdPartyRegistryRemote CDN loader with manifest-first lazy loading

[shivasurya]

Summary

• Implements GoThirdPartyRegistryRemote mirroring the GoStdlibRegistryRemote architecture for third-party package metadata
• Manifest-first loading from {baseURL}/go-thirdparty/v1/manifest.json with lazy per-package CDN downloads
• Write-lock serialization during downloads prevents duplicate HTTP requests under concurrent callers (same pattern as stdlib remote)
• Checksum verification using "sha256:" prefix format; empty checksum skips verification for development convenience
• Module path encoding: slashes replaced with underscores (gorm.io/gorm → gorm.io_gorm.json)
• Compile-time GoThirdPartyLoader interface compliance assertion in tests
• 40+ tests covering constructor, manifest loading, cache hits, checksum mismatch, HTTP errors, concurrency, and double-check locking

Test plan

• go build ./graph/callgraph/registry/... — clean compilation
• go test ./graph/callgraph/registry/ -count=1 — all tests pass
• golangci-lint run ./graph/callgraph/registry/go_thirdparty_remote.go — zero issues
• Concurrent access test validates single download under 20 concurrent goroutines
• Interface compliance assertion: var _ core.GoThirdPartyLoader = (*GoThirdPartyRegistryRemote)(nil)

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	2
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 98.26087% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.45%. Comparing base (87ba846) to head (265de65).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...e/graph/callgraph/registry/go_thirdparty_remote.go	98.26%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #646      +/-   ##
==========================================
+ Coverage   84.39%   84.45%   +0.05%     
==========================================
  Files         162      163       +1     
  Lines       23449    23564     +115     
==========================================
+ Hits        19789    19900     +111     
- Misses       2916     2918       +2     
- Partials      744      746       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• feat(cache): delta-based incremental SQLite analysis cache for Go #649
• feat: GoThirdPartyCombinedLoader — CDN-first + local fallback routing #648
• feat: CDN registry generator for Go third-party packages #647
• feat: GoThirdPartyRegistryRemote CDN loader with manifest-first lazy loading #646 👈 (View in Graphite)
• feat: Go resolution statistics in resolution-report command #645
• feat: Go third-party QueryType classes + GORM SQLi & Gin SSRF rules #644
• feat(go): package-level var Source 3 + StdlibLoader embed resolution #643
• feat(go): eager scope creation + parameter-aware RHS inference #642
• feat(go): third-party type resolution from vendor/GOMODCACHE #641
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Apr 7, 8:35 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 7, 8:44 PM UTC: Graphite rebased this pull request as part of a merge.
• Apr 7, 8:45 PM UTC: @shivasurya merged this pull request with Graphite.