feat(fips): polyglot crypto detection program (ring 3, ADR-004 follow-on)

[williaby]

Summary

Extend PQC readiness crypto detection beyond Python to the rest of the fleet's
languages. This is ring 3 of the scope defined in
ADR-004. It is a
downstream program, not a single ADR.

Why

The org is polyglot, so a Python-only checker addresses only a fraction of
org-wide quantum exposure. Ring 3 is the largest raw-exposure gap, but also the
largest engineering lift (one detector per ecosystem) with the least reuse from
the Python tool, so it is sequenced over time rather than decided in one document.

Scope (sequenced, one detector per ecosystem)

Candidate ecosystems, prioritized by fleet footprint:

• Go
• JavaScript / TypeScript
• Container images (base-image and embedded crypto)
• Terraform / IaC (TLS config, KMS key specs)

Each detector emits into the shared CycloneDX 1.6 CBOM and the homelab-infra fleet
dashboard established by ADR-004, so coverage grows additively.

Design notes / constraints

• Do NOT try to build this as one monolithic tool. Each ecosystem gets its own
  detector (likely its own reusable workflow) feeding the shared CBOM.
• Depends on the D2 (CBOM format) and D3 (aggregator/dashboard) contract from
  ADR-004 being in place first.

Acceptance

• Per-ecosystem detectors tracked as their own sub-issues/ADRs as they are
  scheduled.
• Non-Python crypto assets appear in the fleet dashboard.