[0.5] Evaluate SARIF output without changing the current report schema

[SetraTheXX]

Context

JSON is the primary machine-readable report. SARIF may help security tooling,
but adding a second output contract before the current schema is stable could
create unnecessary compatibility cost.

Goal

Evaluate whether SARIF adds enough value for the 0.5 audience and define a
small design if the answer is yes.

Acceptance criteria

• Identify target consumers and concrete CI or code-scanning workflows.
• Map current risk definitions to SARIF concepts without losing details.
• Document output stability, severity mapping, and exit-code behavior.
• Decide explicitly: implement in 0.5, defer, or reject.
• Add no implementation unless the design is accepted.

Non-goals

• Replacing the existing JSON report.
• Adding runtime network access or a hosted service.