feat(scanner): reject plugin gradle publish and luarocks upload

[seonghobae]

Successor of #1186 / issue #1099. Does not Close those. cabal/mvn stay #1186. hex/conda stay #1185. dart/flutter pub stay #1184. gem/nuget stay #1183. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs remaining Gradle and LuaRocks writes that #1186 left as inventory:

• gradle publish and wrapper gradlew publish as claude-plugin-gradle-publish-command (CWE-269)
• luarocks upload as claude-plugin-luarocks-upload-command (CWE-250)
• gradle tasks, gradle publishToMavenLocal, and luarocks list stay inventory
• cabal upload stays claude-plugin-cabal-upload-command
• unquoted # comments, echo/printf lookalikes, assignment values, and marketplace description prose are not this class
• README gradle/luarocks wording is not a hook command
• snippets are command labels, not tokens or secrets
• composer publish and go upload are not invented; they are not real package-manager CLIs

Also drop the terraform/helm leftover scan_result == pass lock on vercel deploy / fly deploy; those commands are already fail-closed by #1174 and are not this class.

#1186 remains owner of cabal/mvn publish.

Evidence

• RED 83a9abd then GREEN a2a800a
• tests/test_claude_plugin_gradle_luarocks.py plus sibling cabal/hex/gem lock
• plugin coverage suite 556 passed on Python 3.13

Relates to #1099. Relates to #1186.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}