M7.2: Integrate registry rules into scan flow

[bjcorder]

Labels: type:feature, area:scanner, area:registry,
priority:high, status:blocked, milestone:M7, cross-repo

Summary

Use registry rules during scans to refine findings via Level 2
applicability analysis.

Acceptance criteria

• When ancestry+equivalence checks are inconclusive, the scanner
  fetches relevant rules from the registry and invokes Semgrep against
  the fork's source tree
• Semgrep is invoked as a subprocess
• Findings include rule-based evidence in their evidence_json
• Scan gracefully degrades when Semgrep is not installed
  (continues without Level 2 checks)
• Tests verify rule-based refinement on a synthetic case

Dependencies

Depends on: #34

---