feat: wire cargo-deny output into weak_points emission

Implements issue #101: Add cargo-deny scanner integration that emits
weak_points for license policy violations, security advisories,
banned dependencies, and unknown sources.

- Add 4 new WeakPointCategory variants: LicensePolicy, Advisory,
  BannedDep, UnknownSource
- Create src/scan/cargodeny.rs with full cargo-deny integration
- Parse JSON/SARIF output and map to WeakPoint structures
- Severity mapping: Error->High, Warning->Medium, Note->Low
- Code-to-category mapping for RUSTSEC, CVE, banned, license, etc.
- Per estate policy: do_not_automate=true for all findings
- Add sarif feature to Cargo.toml
- Update panll and report/sarif matches for new categories

Closes #101

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

Cargo.toml

@@ -39,6 +39,7 @@ ureq = { version = "3.3", optional = true }
 default = []
 signing = ["ed25519-dalek"]
 http = ["ureq"]
+sarif = []
 # Native GUI viewer (eframe/egui). Opt-in because eframe raises MSRV above the
 # 1.85.0 baseline; default builds remain pure-CLI and MSRV-clean.
 gui = ["eframe"]

src/lib.rs

@@ -27,6 +27,7 @@ pub mod assemblyline;
 pub mod attack;
 pub mod attestation;
 pub mod axial;
+pub mod scan;
 #[cfg(feature = "http")]
 pub mod bridge;
 pub mod campaign;

src/panll/mod.rs

@@ -323,6 +323,10 @@ fn category_label(cat: WeakPointCategory) -> &'static str {
         WeakPointCategory::SupplyChain => "supply-chain",
         WeakPointCategory::InputBoundary => "input-boundary",
         WeakPointCategory::MutationGap => "mutation-gap",
+        WeakPointCategory::LicensePolicy => "license-policy",
+        WeakPointCategory::Advisory => "advisory",
+        WeakPointCategory::BannedDep => "banned-dep",
+        WeakPointCategory::UnknownSource => "unknown-source",
     }
 }
 

src/report/sarif.rs

@@ -141,6 +141,10 @@ pub(crate) fn rule_id(category: &WeakPointCategory) -> &'static str {
         WeakPointCategory::SupplyChain => "PA023",
         WeakPointCategory::InputBoundary => "PA024",
         WeakPointCategory::MutationGap => "PA025",
+        WeakPointCategory::LicensePolicy => "PA026",
+        WeakPointCategory::Advisory => "PA027",
+        WeakPointCategory::BannedDep => "PA028",
+        WeakPointCategory::UnknownSource => "PA029",
     }
 }
 
@@ -173,6 +177,10 @@ pub(crate) fn rule_name(category: &WeakPointCategory) -> &'static str {
         WeakPointCategory::SupplyChain => "supply-chain",
         WeakPointCategory::InputBoundary => "input-boundary",
         WeakPointCategory::MutationGap => "mutation-gap",
+        WeakPointCategory::LicensePolicy => "license-policy",
+        WeakPointCategory::Advisory => "advisory",
+        WeakPointCategory::BannedDep => "banned-dep",
+        WeakPointCategory::UnknownSource => "unknown-source",
     }
 }