Security:
- Add _INLINE_DANGEROUS_OPTIONS regex to catch pip options after package
names (--find-links, --constraint, --requirement, --editable, --trusted-host,
--global-option, --install-option and short forms)
- Stage index URLs in pending_urls, commit only after full line validation
to prevent URL injection from rejected lines
Tests:
- Add 50 new tests: inline sanitization, false-positive guards, parse
helpers (_parse_conflicts, _parse_install_output), exception paths
(91 → 141 total, all pass)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
