feat(cli): emit governance findings as SARIF 2.1.0

[clay-good]

Status

Not LGTM yet. Four parallel adversarial reviews and CI are in progress.

What was missing

Governance findings reached consumers only through the openlore review Markdown briefing and the openlore enforce exit code. Code-scanning surfaces (per-line PR annotations, dismissal workflows, rules on scanning results) read SARIF, and OpenLore wrote none, so a team had to parse OpenLore's JSON in custom CI glue.

What it does

Piece	Behavior
Flag	--sarif <path> on openlore enforce and openlore review also writes a SARIF 2.1.0 log. Not combinable with enforce --agent-hook.
Rules	Every code in FINDING_CODE_REGISTRY, sorted, with its description, source, and default enforcement class.
Results	One per classified finding, sorted: message verbatim; level from a fixed table (critical/error → error, warning → warning, info → note); enforcement class, severity, source, subject, and baseline state as properties; a SHA-256 of the finding identity in partialFingerprints.
Locations	A recorded repository-relative location becomes a physical location, with a line only when recorded. No location, an absolute path, or a path that escapes the root becomes a logical location named by the subject.
Run	Tool name and version, the call-graph fingerprint when an index exists, and the command's caveats. No timestamps.
Transport, not policy	Printed output and exit codes are the same with or without the flag; a write failure is a warning on stderr.

Proof

• src/core/services/sarif.test.ts: every registry code as a sorted rule; a located finding's physical location, verbatim message, level, and class property; logical-only locations for no, absolute, escaping, and Windows-absolute paths; the full level table and unregistered codes; byte-identical output for reordered input with no timestamps.
• src/cli/commands/enforce.test.ts: runEnforceCli({ json: true }) with and without --sarif gives the same exit code and the same stdout, and writes a SARIF 2.1.0 log; --agent-hook with --sarif is refused.
• Spec archived: 2026-09-13-add-sarif-finding-emission (ADD FindingsAreEmittableAsSarifTransport). openspec validate --specs --strict passes.

Notes

• Narrowed from the proposal: locations come from each finding's recorded location (no graph span lookup), rules have no helpUri, and the log shape is checked structurally rather than against a vendored JSON schema.
• No MCP tool changes.

🤖 Generated with Claude Code