[task] Create package extraction framework to eliminate duplication

[github-actions]

Objective

Eliminate ~75% code duplication in package extraction logic by creating a generic PackageExtractor framework that can be used across npm, pip, uv, and Go package managers.

Context

Currently extractNpxFromCommands (npm.go), extractPipFromCommands (pip.go), extractUvFromCommands (pip.go), and extractGoFromCommands (dependabot.go) all contain nearly identical logic (~150 lines total) for parsing command-line strings and extracting package names.

Related to #3713 - Duplicate #1: Package Extraction Pattern (High Priority).

Approach

1. Create pkg/workflow/package_extraction.go with a generic extraction framework:

type PackageExtractor struct {
    CommandNames []string          // e.g., ["pip", "pip3"]
    RequiredSubcommand string      // e.g., "install" (optional)
    TrimSuffixes string           // e.g., "&|;"
}

func (pe *PackageExtractor) ExtractPackages(commands string) []string {
    // Generic implementation with common logic:
    // - Split commands by newlines
    // - Split lines into words
    // - Find package manager command
    // - Skip flags (starting with -)
    // - Extract package names
    // - Trim trailing shell operators
}

2. Refactor existing extraction functions to use the framework:

   • Update extractNpxFromCommands in npm.go
   • Update extractPipFromCommands and extractUvFromCommands in pip.go
   • Update extractGoFromCommands in dependabot.go

3. Update all tests to ensure behavior is preserved

Files to Create

• pkg/workflow/package_extraction.go
• pkg/workflow/package_extraction_test.go

Files to Modify

• pkg/workflow/npm.go - Use PackageExtractor
• pkg/workflow/pip.go - Use PackageExtractor for both pip and uv
• pkg/workflow/dependabot.go - Use PackageExtractor for Go
• Existing test files for npm, pip, and dependabot

Acceptance Criteria

• PackageExtractor type created with generic extraction logic
• All four extraction functions refactored to use the framework
• Code reduction: ~150 lines → ~50 lines
• All existing tests pass without modification
• Extraction behavior is identical to original implementation
• Framework is flexible enough to support different package managers
• Code is DRY - no duplicated extraction logic remains
  Related to [refactor] 🔧 Semantic Function Clustering Analysis: Refactoring Opportunities #3713

AI generated by Plan Command for #3713