M5.3: Implement JSON report renderer

[bjcorder]

Labels: type:feature, area:report, priority:critical,
status:blocked, milestone:M5, phase:9

Summary

Render scan results as structured JSON per the documented schema.

Acceptance criteria

• internal/report/json.go exposes:
  • func RenderJSON(scan Scan, findings []Finding) ([]byte, error)
• Output matches the schema in design doc § 13:
  • Top-level: scan_id, fork, upstream, started_at,
    finished_at, summary, findings
  • summary has counts per status
  • Each finding has advisory_id, severity, summary, status,
    fix_commits_checked, evidence
• JSON is indented with 2 spaces for readability
• Tests verify schema conformance

Dependencies

Depends on: #20

---