- render_sarif() maps each Signal to a SARIF result, rules deduped by kind
- Severity -> level: critical/high = error, medium = warning, low/info = note
- Evidence file/line become physicalLocation so GitHub code scanning
renders inline source links
- --format sarif on scan and diff subcommands
