[codex] Restore risk taxonomy report wiring

[leemeo3]

Summary

• restore the non-invasive risk taxonomy wiring from PR [codex] Add security finding taxonomy mappings #213 into audit normalization, audit Markdown/SARIF, Code Scanning SARIF, and the package entrypoint
• add tests/risk-taxonomy.test.ts coverage for exact rule lookup, category fallback, unknown-rule handling, taxonomyTags edge cases, and focused audit/SARIF output assertions

References PR #213 and issue #169. This does not reopen or close the completed issue.

Code of Conduct

By submitting this pull request, I agree to follow the project's Contributor Covenant Code of Conduct.

Validation

• npm test -- tests/risk-taxonomy.test.ts tests/audit.test.ts tests/sarif.test.ts passed: 3 files, 19 tests
• npm run typecheck passed
• npm run build passed
• npm run smoke passed
• git diff --check passed
• npm run lint is currently blocked by inherited origin/main failures: 15 existing errors in scripts/metrics-dashboard.ts and src/telemetry.ts; reproduced on detached origin/main@43f0548
• npm test is currently blocked by inherited origin/main failures: public-docs-privacy.test.ts, setup-ci-conversion.test.ts, and cli-entrypoint.test.ts; the same three failures reproduced on detached origin/main@43f0548 when running those failing files

Draft because the current inherited main failures prevent a fully green check. The taxonomy-specific and build/smoke validations above pass.

Artifact Impact

• adds optional taxonomy metadata back to audit findings and SARIF rule/result properties for already-mapped findings
• no compliance framework additions, dynamic CVSS changes, generated docs, dependency, lockfile, workflow, or unrelated refactor changes

AI assistance

This PR was prepared with AI assistance under human direction and checked with the validation commands listed above.