feat(resolver): port SecurityAdvisoryPoolFilter::filter

Implement the security advisory pool filter end to end, plus the
remaining actionable wirings it unblocked.

- Unify the PartialSecurityAdvisory|SecurityAdvisory union as the
  PartialOrFullSecurityAdvisory enum and make the advisory types Clone,
  so advisories can be collected and stored; Pool.security_removed_versions
  now carries the union. This also unblocks PoolOptimizer's clone of the
  security-removed versions.
- Thread the filter result through run_security_advisory_filter/build_pool
  as anyhow::Result.
- Introduce typed PlatformRepositoryHandle and pass platform repos as
  handles through determine_requirements instead of &PlatformRepository.
- Wire RuleSetGenerator's is_unacceptable_fixed_or_locked_package check
  and UpdateCommand's non-locked installed-packages branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/crates/shirabe/src/command/init_command.rs b/crates/shirabe/src/command/init_command.rs
index 38e620b..678e76d 100644
--- a/crates/shirabe/src/command/init_command.rs
+++ b/crates/shirabe/src/command/init_command.rs
@@ -29,6 +29,7 @@ use crate::json::JsonValidationException;
 use crate::package::base_package::{self, BasePackage};
 use crate::repository::CompositeRepository;
 use crate::repository::PlatformRepository;
+use crate::repository::PlatformRepositoryHandle;
 use crate::repository::RepositoryFactory;
 use crate::util::Filesystem;
 use crate::util::ProcessExecutor;
@@ -733,7 +734,7 @@ impl InitCommand {
                 "stable".to_string()
             };
         // TODO(phase-b): repos instanceof CompositeRepository downcast
-        let _platform_repo: Option<&PlatformRepository> = None;
+        let _platform_repo: Option<&PlatformRepositoryHandle> = None;
 
         // (omitted: iterate repos to find PlatformRepository instance)