feat(08-01): add pkg/dorks foundation (schema, loader, registry, executor)

- Dork schema with Validate() mirroring provider YAML pattern
- go:embed loader tolerating empty definitions tree
- Registry with List/Get/Stats/ListBySource/ListByCategory
- Executor interface + Runner dispatch + ErrSourceNotImplemented
- Placeholder definitions/.gitkeep and repo-root dorks/.gitkeep
- Full unit test coverage for registry, validation, and runner dispatch

pkg/dorks/loader.go

@@ -0,0 +1,60 @@
+package dorks
+
+import (
+	"embed"
+	"errors"
+	"fmt"
+	"io/fs"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// definitionsFS embeds every file under pkg/dorks/definitions. The trailing
+// `/*` is deliberate: it tolerates an empty tree containing only a .gitkeep
+// placeholder, which is the case for this foundation plan before Wave 2
+// plans drop in 150+ real dork YAML files.
+//
+//go:embed definitions/*
+var definitionsFS embed.FS
+
+// loadDorks walks the embedded definitions tree and returns every Dork found
+// in a *.yaml file. Non-YAML files (e.g. .gitkeep) are ignored, empty trees
+// return (nil, nil), and parse or validation errors are wrapped with the
+// offending file path.
+func loadDorks() ([]Dork, error) {
+	var dorks []Dork
+	err := fs.WalkDir(definitionsFS, "definitions", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			// Empty definitions directory (only .gitkeep) is valid.
+			if errors.Is(err, fs.ErrNotExist) {
+				return fs.SkipAll
+			}
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.EqualFold(filepath.Ext(path), ".yaml") && !strings.EqualFold(filepath.Ext(path), ".yml") {
+			return nil
+		}
+		data, err := definitionsFS.ReadFile(path)
+		if err != nil {
+			return fmt.Errorf("reading dork file %s: %w", path, err)
+		}
+		var dk Dork
+		if err := yaml.Unmarshal(data, &dk); err != nil {
+			return fmt.Errorf("parsing dork %s: %w", path, err)
+		}
+		if err := dk.Validate(); err != nil {
+			return fmt.Errorf("validating dork %s: %w", path, err)
+		}
+		dorks = append(dorks, dk)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return dorks, nil
+}