Add remote URL and registry package resolution to `missing`, `threat-model` and `sinks`

[abhinavgautam01]

Summary

The primary scan, outline and enrich commands accept remote Git URLs and registry package shorthands. The analysis commands missing, threat-model and sinks currently treat the same arguments as local filesystem paths.

This prevents analysis commands from being used directly against remote projects and registry packages.

Current behavior

Commands such as these fail:

brief missing npm:express
brief threat-model https://github.com/expressjs/express
brief sinks pypi:requests

For example, brief missing npm:express reports an error similar to:

error: path does not exist: /current/directory/npm:express

Root cause

All three commands use runDetection in cmd/brief/threat.go. It passes the argument directly to detect.New without first calling remote.Resolve:

engine := detect.New(knowledgeBase, path)

The remote resolver already supports Git URLs and registry shorthands including npm:, gem:, pypi:, crate:, go:, hex:, nuget: and pub:.

Expected behavior

The following should resolve and scan remote source using the same behavior as the primary command:

brief missing npm:express
brief threat-model https://github.com/expressjs/express
brief sinks pypi:requests

Local path behavior should remain unchanged.

Proposed implementation

• Add --keep, --depth, --dir and --cache to the shared runDetection flag set.
• Resolve the input through remote.Resolve(context.Background(), path, remote.Options{...}) before constructing the detection engine.
• Ensure src.Cleanup() runs after post-processing and output are complete, including relevant error paths.
• Update command usage documentation from [path] to [path | url].
• Add tests using injected or local resolver behavior so command tests do not depend on external network availability.