feat(analyzer): enforce CoA module blocklist in analyzer and build engine

crates/coa-core/src/analyzer.rs

@@ -1185,6 +1185,22 @@ pub fn analyze_github_module_for_realm(
     let mut report = analyze_github_repository(url_str, cache_base_dir)?;
     report.sdk_fingerprint = Some(realm_sdk_fingerprint.clone());
 
+    if let Some(reason) = crate::catalogue::is_blocked_repo(url_str) {
+        report.findings.push(CompatibilityFinding {
+            rule_id: "COA_POLICY_BLOCKED".into(),
+            severity: FindingSeverity::Critical,
+            confidence: FindingConfidence::High,
+            file: "repository".into(),
+            line: 0,
+            explanation: format!("This module is blocked by CoA project policy: {}", reason),
+            recommended_action: "Installation of this repository is blocked due to known fatal issues or security risks.".into(),
+            evidence: format!("Repository: {}, Block reason: {}", url_str, reason),
+            is_auto_fixable: false,
+        });
+        report.classification = CompatibilityClassification::SourceIncompatible;
+        report.reasons.push(format!("Blocked by CoA policy: {}", reason));
+    }
+
     let v03_fingerprint = SdkExportContract::v03().abi_fingerprint;
     if realm_sdk_fingerprint != v03_fingerprint {
         report.findings.push(CompatibilityFinding {

crates/coa-core/src/build_engine.rs

@@ -402,6 +402,9 @@ pub fn build_module_from_source(
     let sdk_dir = toolchain.sdk_dir.unwrap();
 
     let (module_id, display_name, source_commit) = resolve_module_identity(module_source_dir);
+    if let Some(reason) = crate::catalogue::is_blocked_repo(&module_id) {
+        return Err(Error::Invalid(format!("[MODULE_BLOCKED] Module '{}' is blocked by CoA project policy: {}", module_id, reason)));
+    }
     let raw_module_name = module_source_dir.file_name()
         .map(|n| n.to_string_lossy().into_owned())
         .unwrap_or_else(|| module_id.clone());