feat: add SARIF 2.1.0 output format for GitHub Advanced Security integration

[Copilot]

Adds --format sarif to the CLI so skillguard findings can be uploaded to the GitHub Security tab as code-scanning alerts.

New: src/skillguard/sarif.py

• results_to_sarif(results: list[SkillScanResult]) -> dict — core converter
• report_to_sarif(report: BatchScanReport) -> dict — batch convenience wrapper
• to_sarif_string(results, indent=2) -> str — JSON serialisation helper
• All 12 rules emitted as SARIF reportingDescriptor entries in tool.driver.rules
• Severity → SARIF level: CRITICAL/HIGH → error, MEDIUM → warning, LOW → note, INFO → none
• Each finding produces a result with ruleId, ruleIndex, level, message.text, and locations[].physicalLocation (uri + startLine)
• Windows backslash paths normalised to forward slashes

CLI (src/skillguard/cli.py)

• --format choices extended: text | json | sarif
• SARIF branch added for both single-file and directory scan paths

Usage

# Single file
skillguard scan SKILL.md --format sarif > results.sarif

# Directory
skillguard scan ./skills/ --format sarif > results.sarif

GitHub Actions upload:

- name: Scan skills
  run: skillguard scan ./skills/ --format sarif > skillguard.sarif

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: skillguard.sarif
    category: skillguard

Tests (tests/test_sarif.py)

37 tests covering: SARIF schema/version fields, rule descriptor completeness, result fields, multi-skill batches, URI normalisation, and CLI subprocess output.

README

Output formats section updated; new SARIF sub-section with the Actions snippet above; roadmap item marked complete.