Fix rule bugs, expand rule set, add multi-file input

[davidgrldo]

Follow-up to a review of dockopt: three correctness fixes, an analyzer cleanup, a broader rule set, and batch (multi-file) analysis.

Bug fixes

Each has a regression test and a binary-level CI fixture contract.

• GO002 false error — no longer fires when CGO_ENABLED=0 is set via a stage-level ENV/ARG (previously only the inline RUN form was recognized, so idiomatic Dockerfiles failed CI with an error-grade finding).
• Here-string parse failure — bash here-strings (<<<) are no longer misparsed as heredocs (previously parse_error, exit 2).
• GEN001 coverage gap — untagged base images (implicit :latest) are now flagged, while exempting scratch, digest-pinned images, and prior stage references.

Analyzer cleanup (behavior-preserving)

• Removed the dead Context struct threaded through every rule.
• Collapsed the single-implementation Rule interface + defensive copy layers into a concrete rule registry.
• Stack is detected once per run instead of twice.

New rules

ID	Severity	Checks
GEN002	warn	apt-get install without --no-install-recommends
GEN003	warn	apt-get install without clearing /var/lib/apt/lists in the same RUN
GEN004	warn	ADD <url> anti-pattern
GEN005	warn	final stage running as root

JAVA001 broadened to all JDK versions/repos (openjdk, eclipse-temurin, amazoncorretto) instead of the single exact tag openjdk:17.

Multi-file input

• Accepts N Dockerfile paths (shell globbing supported).
• JSON output becomes JSON Lines; single-file output is byte-identical to before (backward compatible).
• Human output gets per-file ==> path <== headers; exit code is the most severe outcome across all paths (2 > 1 > 0).

Docs & tests

• README gains a full rules reference and a multi-file section.
• 5 new complex fixtures (ENV-CGO clean build, here-string+heredoc, untagged base, apt anti-patterns, realistic distroless multi-stage).
• Test count 96 → 123. gofmt/go vet clean, -race clean, fuzz clean, CI fixture contract replayed locally.

Known limitations (marked with ponytail: comments in code + noted in README)

• Heredoc bodies aren't analyzed.
• apt-get -y install (flag before the subcommand) isn't detected.

🤖 Generated with Claude Code