feat: ingest SARIF analyzer evidence

[haasonsaas]

Summary

• add a built-in SARIF/code-scanning pre-analyzer that ingests configured repo-local reports
• convert changed-file SARIF results into deterministic analyzer findings plus provenance-marked LLM context
• document plugins.sarif_reports and keep reports disabled unless configured

Research basis

The SOTA pass over the arXiv/GitHub corpus pointed at hybrid analyzer+LLM review loops: external tools should become replayable, diff-scoped evidence rather than informal background. This is the smallest durable slice of that direction.

Verification

• cargo fmt --check
• cargo test sarif
• cargo test load_builtin_plugins
• cargo clippy --all-targets -- -D warnings
• cargo test (1569 passed)
• pre-push hook with Homebrew Python 3.12 in PATH: workflow validation, version check, fmt, clippy, web npm ci && npm run build && npm run test, cargo test