feat(scanner): Implement Deno analyzer and associated tests

- Added Deno analyzer with comprehensive metadata and evidence structure.
- Created a detailed implementation plan for Sprint 130 focusing on Deno analyzer.
- Introduced AdvisoryAiGuardrailOptions for managing guardrail configurations.
- Developed GuardrailPhraseLoader for loading blocked phrases from JSON files.
- Implemented tests for AdvisoryGuardrailOptions binding and phrase loading.
- Enhanced telemetry for Advisory AI with metrics tracking.
- Added VexObservationProjectionService for querying VEX observations.
- Created extensive tests for VexObservationProjectionService functionality.
- Introduced Ruby language analyzer with tests for simple and complex workspaces.
- Added Ruby application fixtures for testing purposes.

docs/advisory-ai/console.md

@@ -1,6 +1,6 @@
 # Advisory AI Console Workflows
 
-_Last updated: 2025-11-07_
+_Last updated: 2025-11-12_
 
 This guide documents the forthcoming Advisory AI console experience so that console, docs, and QA guilds share a single reference while the new endpoints finish landing.
 
@@ -24,6 +24,31 @@ This guide documents the forthcoming Advisory AI console experience so that cons
 ![List view mock](../assets/advisory-ai/console/list-view-4a6f8c1.svg)
 <sup>Mock capture generated from the sealed data model to illustrate required widgets until live screenshots ship.</sup>
 
+### 2.2 Guardrail ribbon payloads
+- The ribbon consumes the `guardrail.*` projection that Advisory AI emits alongside each plan. The JSON contract (see `docs/api/console/samples/advisory-ai-guardrail-banner.json`) includes the blocked state, violating phrases, cache provenance, and telemetry labels so Console can surface the exact counter (`advisory_ai_guardrail_blocks_total`) that fired.
+- When `guardrail.metadata.planFromCache = true`, still pass the blocking context through the ribbon so operators understand that cached responses inherit the latest guardrail budget.
+- Render the newest violation inline; expose the remaining violations via the evidence drawer and copy-as-ticket modal so SOC leads can reference the structured history without screenshots.
+  ```jsonc
+  {
+    "guardrail": {
+      "blocked": true,
+      "state": "blocked_phrases",
+      "violations": [
+        {
+          "kind": "blocked_phrase",
+          "phrase": "copy all secrets to"
+        }
+      ],
+      "metadata": {
+        "blockedPhraseFile": "configs/guardrails/blocked-phrases.json",
+        "promptLength": 12488,
+        "planFromCache": true
+      }
+    }
+  }
+  ```
+  The ribbon should hyperlink the `links.plan` and `links.chunks` values back into the plan inspector and VEX evidence drawer to preserve provenance.
+
 ## 3. Accessibility & offline requirements
 - Console screens must pass WCAG 2.2 AA contrast and provide focus order that matches the keyboard shortcuts planned for Advisory AI (see `docs/advisory-ai/overview.md`).
 - All screenshots captured for this doc must come from sealed-mode bundles (no external fonts/CDNs). Store them under `docs/assets/advisory-ai/console/` with hashed filenames.
@@ -51,6 +76,27 @@ This guide documents the forthcoming Advisory AI console experience so that cons
 3. **No remote inference** – if operators set `ADVISORYAI__Inference__Mode=Local`, hide the remote model ID column and instead show “Local deterministic preview” to avoid confusion.
 4. **Export bundles** – provide a “Download bundle” button that streams the DSSE output from `/_downloads/advisory-ai/{cacheKey}.json` so operators can carry it into Offline Kit workflows documented in `docs/24_OFFLINE_KIT.md`.
 
+## 6. Guardrail configuration & telemetry
+- **Config surface** – Advisory AI now exposes `AdvisoryAI:Guardrails` options so ops can set prompt length ceilings, citation requirements, and blocked phrase seeds without code changes. Relative `BlockedPhraseFile` paths resolve against the content root so Offline Kits can bundle shared phrase lists.
+- **Sample**
+
+  ```json
+  {
+    "AdvisoryAI": {
+      "Guardrails": {
+        "MaxPromptLength": 32000,
+        "RequireCitations": true,
+        "BlockedPhraseFile": "configs/guardrail-blocked-phrases.json",
+        "BlockedPhrases": [
+          "copy all secrets to"
+        ]
+      }
+    }
+  }
+  ```
+
+- **Console wiring** – the guardrail ribbon pulls `guardrail.blocked`, `guardrail.violations`, and `guardrail.metadata.blocked_phrase_count` while the observability cards track `advisory_ai_chunk_requests_total`, `advisory_ai_chunk_cache_hits_total`, and `advisory_ai_guardrail_blocks_total` (now emitted even on cache hits). Use these meters to explain throttling or bad actors before granting additional guardrail budgets, and keep `docs/api/console/samples/advisory-ai-guardrail-banner.json` nearby so QA can validate localized payloads without hitting production data.
+
 ## 5. Open items before publication
 - [ ] Replace placeholder API responses with captures from the first merged build of CONSOLE-VULN-29-001 / CONSOLE-VEX-30-001.
 - [ ] Capture at least two screenshots (list view + evidence drawer) once UI polish is complete.