fix(supply_chain): replace exponential Levenshtein with iterative DP (#329)

## Summary

The previous \`levenshtein_rows\` implementation was a naïve recursive
edit-distance that branched three ways at every position, giving
O(3^min(n,m)) worst-case time. Fine on the 4-6 char fixtures the unit
tests exercise; catastrophic on real GitHub-Action slugs like
\`actions/checkout@v4\` (16 chars) — a single typosquat comparison took
several seconds, and an estate-wide scan hung indefinitely (each
workflow file kicks off ~30 comparisons against the known-good
allowlist).

## What changed

\`lib/rules/supply_chain.ex\` — \`levenshtein/2\` now uses:

* **Iterative DP** — O(n*m) time, O(m) space (single rolling row).
* **\`abs(n-m) > 2\` short-circuit** — typosquat detection only cares
about edit-distance ≤ 2; we return 3 immediately when the length
difference already exceeds that, skipping the DP work entirely.

## Smoke test

Scanned \`gitbot-fleet\` (the repo that originally hung):

| | Before | After |
|---|---|---|
| Elapsed | ≥60s (timeout, no result) | **20 ms** |
| Findings | — | 3 |

## Why this matters

Full estate self-scan (279 repos) previously hung at repo ~20 (timeouts
cascaded). With this fix, the scan completes in ~30s and surfaced 8,025
findings across 21 rules — that's the corpus the rules-coverage handoff
(see CLAUDE.md → "Outstanding work") works from.

## Test plan

- [x] Smoke: gitbot-fleet scan returns in <30s
- [ ] CI green
- [ ] Existing unit tests for SC004 (\`test/supply_chain_test.exs\`)
still pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

lib/rules/supply_chain.ex

@@ -686,29 +686,50 @@ defmodule Hypatia.Rules.SupplyChain do
     end
   end
 
-  # Simple Levenshtein distance — adequate for the typosquat scope.
+  # Iterative O(n*m) Levenshtein. The naïve recursive form was
+  # exponential — fine on short test inputs, but ~3^32 on real
+  # action-slug pairs which led to scan-time hangs.
   defp levenshtein(a, b) do
     a_list = String.graphemes(a)
     b_list = String.graphemes(b)
-    levenshtein_rows(a_list, b_list)
+    n = length(a_list)
+    m = length(b_list)
+
+    cond do
+      n == 0 -> m
+      m == 0 -> n
+      abs(n - m) > 2 -> 3  # short-circuit: caller only cares about <= 2
+      true -> dp_levenshtein(a_list, b_list, m)
+    end
   end
 
-  defp levenshtein_rows([], b), do: length(b)
-  defp levenshtein_rows(a, []), do: length(a)
+  defp dp_levenshtein(a_list, b_list, m) do
+    init_row = Enum.to_list(0..m)
 
-  defp levenshtein_rows([ah | at], [bh | bt] = b) do
-    cond do
-      ah == bh ->
-        levenshtein_rows(at, bt)
+    Enum.with_index(a_list, 1)
+    |> Enum.reduce(init_row, fn {ah, i}, prev_row ->
+      [first | _] = prev_row
 
-      true ->
-        1 +
-          Enum.min([
-            levenshtein_rows(at, b),
-            levenshtein_rows([ah | at], bt),
-            levenshtein_rows(at, bt)
-          ])
-    end
+      {row, _} =
+        Enum.reduce(Enum.with_index(b_list, 1), {[i], prev_row}, fn {bh, _j},
+                                                                    {acc, [pl, pr | rest]} ->
+          cost = if ah == bh, do: 0, else: 1
+          [cur | _] = acc
+
+          val =
+            Enum.min([
+              cur + 1,
+              pr + 1,
+              pl + cost
+            ])
+
+          {[val | acc], [pr | rest]}
+        end)
+
+      _ = first
+      Enum.reverse(row)
+    end)
+    |> List.last()
   end
 
   defp fetch_repo_archived(slug) do