Add SARIF export support

[jadenfix]

What changed

Adds deepsec export --format sarif --out <file> with SARIF 2.1.0 rules, repository-relative source locations, DeepSec metadata, and deterministic partial fingerprints. GitHub code scanning receives security severity for security findings and correctness metadata for non-security bugs. Sparse evidence lines are emitted as one exact primary location plus related locations.

SARIF now requires exactly one project per file so repository-relative paths cannot be attributed to the wrong repository. The official GitHub upload action and required workflow permission are documented.

Why

JSON and Markdown exports require custom integrations. SARIF gives DeepSec users a standard interchange format for code-scanning consumers such as GitHub while preserving correct alert classification and stable identity.

Verification

• Full workspace tests: 2,191 passed; the credential-gated live-sandbox test was skipped as designed
• pnpm lint, pnpm knip, pnpm -r build, pnpm bundle, and pnpm typecheck:deepsec pass
• 16 focused SARIF/export tests pass
• Generated output validates against the SARIF 2.1.0 JSON schema
• Bundled pipeline E2E exports and parses SARIF from the shipped CLI path

Notes for reviewer

DeepSec emits a stable generic partial fingerprint. The official GitHub upload action augments uploaded results with its source-based primaryLocationLineHash. The branch is based on the current main.

[vercel]

@jadenfix is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[jadenfix]

Ready for review at ceacf51. Full workspace validation is complete: build, lint, knip, bundle, published-config typecheck, and 2,191 tests pass; only the credential-gated live-sandbox test is skipped as designed. The 16 focused SARIF tests pass, generated output validates against the SARIF 2.1.0 schema, and the bundled pipeline E2E exercises the shipped CLI. GitHub Actions remain action_required for this fork, and Vercel previews require Vercel Labs authorization; an upstream maintainer must approve those service gates.