feat: auditable finding suppressions and enforced security invariants

[hlinor-systems]

What changed

• Enforce adversarial security invariants through the corpus manifest and mutation-based checks.
• Move invariant helpers into test-only code and add full-repository build coverage in CI.
• Add fail-closed finding suppressions with strict schema validation, expiry, reason, duplicate, path, symlink, and unknown-finding checks.
• Preserve suppressed findings in JSON, text, and SARIF output, using SARIF result.suppressions with an auditable justification and expiry metadata.
• Keep suppressed findings excluded from --fail-on while retaining their evidence in generated reports.

Why

Security and compliance users must be able to distinguish an accepted, time-bounded exception from an absent finding. The adversarial corpus must also verify the declared security contract rather than only exercising decorative metadata.

Validation

• gofmt -l .
• go build ./...
• go vet ./...
• go test -race ./...
• Pinned external benchmark: 6/6 cases passed with exact manifest refs; source_acp005: 0 for all cases.
• Demo fixture, SARIF fixture, suppression fail-closed paths, and deterministic output verified.