Expand --report JSON into a compliance audit sidecar

[ababic]

Implements the narrower scope of #13: treat dump seals as provenance on the SQL artifact, and expand --report into the compliance sidecar (not a second copy of the policy fingerprint).

--report audit sidecar

When --report is set, the JSON file records:

• dumpling_version
• run_id / started_at (instance metadata; will not match on re-runs)
• config_source + config_sha256 (SHA-256 of the loaded config file bytes)
• Streaming input_sha256 / output_sha256 of the SQL streams Dumpling actually read/wrote (output_sha256 omitted in --check)
• seal_sha256 — the same digest as dump-seal sha256= (cross-link report ↔ dump)
• flags for gates (check, strict_coverage, scan_output, fail_on_findings, no_seal, …)
• outcomes (strict_coverage_passed, output_scan_passed when those gates ran, trusted_passthrough)

I/O hashing is enabled only when --report is requested.

--no-seal

Skip writing the -- dumpling-seal: SQL comment (useful for stdin/stdout pipelines). Incoming seals are still recognized. --report still records seal_sha256.

cat dump.sql | dumpling --no-seal --report report.json > sanitized.sql

Docs

• dumpling --help long help for --report / --no-seal, plus an Examples block
• Configuration guide: Dump seal and JSON report (audit sidecar)
• CI guardrails → Audit evidence covers verification with a seal line and with --no-seal

Testing

• Unit tests for streaming SHA-256 wrappers and report serialization
• CLI integration: two seeded runs share fingerprint/checksum fields and differ on run_id; --check omits output_sha256; --no-seal omits the SQL comment but keeps seal_sha256
• --help contains Examples, --no-seal, and --report
• cargo fmt --all -- --check, cargo clippy --all-targets --all-features, cargo test --all-targets --all-features (172 tests)

Closes #13